fix(security): harden API against pentest findings

- Default TRUST_PROXY=false to prevent XFF rate limit bypass (PT-01)
- Return 400 instead of 500 on malformed JSON input (PT-03)
- Default MAX_PIPELINE_STEPS=20 to prevent DoS (PT-04)
- Validate clientJobId length (max 128) across all routes (PT-06)
- Add security headers to all reply.hijack() streaming responses (PT-07)
- Sanitize usernames in audit log to prevent stored XSS (PT-08)
- Block TRACE method with 405 response (PT-10)
- Add 429 RateLimited response to OpenAPI spec (PT-12)
- Default MAX_SVG_SIZE_MB=50 to limit SVGZ decompression (PT-13)
- Pin Dockerfile base images by digest
- Sanitize OIDC IdP error and sub claim in audit log
- Sync Docker compose/Dockerfile defaults with env.ts

docker/docker-compose-gpu.yml

@@ -32,7 +32,7 @@ services:
       - CONCURRENT_JOBS=${CONCURRENT_JOBS:-0}
       - MAX_WORKER_THREADS=${MAX_WORKER_THREADS:-0}
       - PROCESSING_TIMEOUT_S=${PROCESSING_TIMEOUT_S:-0}
-      - MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-0}
+      - MAX_PIPELINE_STEPS=${MAX_PIPELINE_STEPS:-20}
       - RATE_LIMIT_PER_MIN=${RATE_LIMIT_PER_MIN:-1000}
       - MAX_USERS=${MAX_USERS:-0}
       - SESSION_DURATION_HOURS=${SESSION_DURATION_HOURS:-168}