fix(security): harden API against pentest findings

- Default TRUST_PROXY=false to prevent XFF rate limit bypass (PT-01)
- Return 400 instead of 500 on malformed JSON input (PT-03)
- Default MAX_PIPELINE_STEPS=20 to prevent DoS (PT-04)
- Validate clientJobId length (max 128) across all routes (PT-06)
- Add security headers to all reply.hijack() streaming responses (PT-07)
- Sanitize usernames in audit log to prevent stored XSS (PT-08)
- Block TRACE method with 405 response (PT-10)
- Add 429 RateLimited response to OpenAPI spec (PT-12)
- Default MAX_SVG_SIZE_MB=50 to limit SVGZ decompression (PT-13)
- Pin Dockerfile base images by digest
- Sanitize OIDC IdP error and sub claim in audit log
- Sync Docker compose/Dockerfile defaults with env.ts

apps/api/src/lib/env.ts

@@ -44,9 +44,9 @@ const envSchema = z
     LOG_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace"]).default("info"),
     MAX_WORKER_THREADS: z.coerce.number().default(0),
     PROCESSING_TIMEOUT_S: z.coerce.number().default(0),
-    MAX_PIPELINE_STEPS: z.coerce.number().default(0),
+    MAX_PIPELINE_STEPS: z.coerce.number().default(20),
     MAX_CANVAS_PIXELS: z.coerce.number().default(0),
-    MAX_SVG_SIZE_MB: z.coerce.number().default(0),
+    MAX_SVG_SIZE_MB: z.coerce.number().default(50),
     MAX_SPLIT_GRID: z.coerce.number().default(100),
     MAX_STORAGE_PER_USER_MB: z.coerce.number().default(5000),
     MAX_WORKSPACE_SIZE_GB: z.coerce.number().default(10),
@@ -55,7 +55,7 @@ const envSchema = z
     LOGIN_ATTEMPT_LIMIT: z.coerce.number().default(30),
     TRUST_PROXY: z
       .enum(["true", "false"])
-      .default("true")
+      .default("false")
       .transform((v) => v === "true"),
     OIDC_ENABLED: z
       .enum(["true", "false"])