fix(security): rate limiting, CORS restriction, tableName allowlist, non-root Docker, migration entrypoint, aria-live

docker-compose.yml

@@ -11,8 +11,9 @@ services:
       POSTGRES_DB: ${POSTGRES_DB:-experiments_db}
     volumes:
       - postgres_data:/var/lib/postgresql/data
-    ports:
-      - "5432:5432"
+    # Port NOT exposed to host — only reachable by backend via internal Docker network
+    expose:
+      - "5432"
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-expuser} -d ${POSTGRES_DB:-experiments_db}"]
       interval: 10s
@@ -32,6 +33,10 @@ services:
       DATABASE_URL: postgresql://${POSTGRES_USER:-expuser}:${POSTGRES_PASSWORD:-exppassword}@postgres:5432/${POSTGRES_DB:-experiments_db}
       NODE_ENV: production
       PORT: 3001
+      CORS_ORIGIN: "http://localhost:52867"
+    # Run as non-root
+    user: "node"
+    entrypoint: ["/bin/sh", "/app/docker-entrypoint.sh"]
     ports:
       - "3001:3001"
     healthcheck: