Security hardening: deps, tenancy quotas, auth, deploy, webhooks

Addresses the findings from the platform security audit. Verified green:
all-workspace typecheck, web build, 16 API unit tests, 23 e2e auth tests,
and 0 high/critical production dependency vulnerabilities.

Dependencies (High):
- Bump drizzle-orm 0.36→0.45.2 (GHSA-gpj5-g38j-94v9 SQLi-via-identifier)
  and drizzle-kit→0.31.10; npm audit fix cleared fast-uri path-traversal
  and the react-router open-redirect. Remaining audit items are dev-only
  build tooling (esbuild/vite), not shipped at runtime.

AI cost control + storage quota (new ai_usage table, migration 0002):
- Per-firm monthly AI token budget enforced before each completion (429),
  with every completion recorded to an ai_usage ledger (lib/ai-usage.ts).
- Enforce per-plan storage quota on upload (402) and maintain
  storage_bytes_used on upload/delete (lib/storage-quota.ts); widen the
  column int→bigint so 8GB/50GB plans don't overflow.

Auth (defense-in-depth):
- Constant-time login: verify against a dummy argon2 hash when the account
  doesn't exist, closing the timing/enumeration oracle (verifyPasswordSafe).
- Enforce suspension on requireSuperadmin, /auth/me, /auth/resend-verification.

Web:
- Validate the post-login ?next= redirect to same-origin paths only
  (open-redirect / phishing).

Deploy hardening:
- docker-compose: memory/CPU limits so a spike can't OOM the Dokploy host.
- .dockerignore: keep destructive one-off scripts (seed-demo, create-admin,
  migrate-storage) out of the runtime image; retain the cron scripts.
- seed-demo.ts: hard-refuse NODE_ENV=production and the prod DB host.

Webhooks / config:
- Stripe idempotency via a stripe_events ledger (skip already-processed
  events; record only after successful processing so a transient failure
  still retries); make the plan-upgraded email non-blocking.
- Rate-limit account export and invoice PDF; cap invoice item arrays at 200.
- Require TURNSTILE_SECRET_KEY in production (bot protection no longer fails
  open on a forgotten key); don't load .env under NODE_ENV=test so the suite
  is hermetic.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

scripts/seed-demo.ts

@@ -93,7 +93,44 @@ function slug(s: string): string {
 // ─── Safety guard ─────────────────────────────────────────────────────────────
 // This inserts 10 demo firms whose owner logins all use the public password `Demo1234!`
 // into whatever DATABASE_URL points at — which for this project is the PRODUCTION database.
-// Require an explicit opt-in so it can never run by accident.
+
+// Hard stop: demo data must NEVER be seeded into production. This runs FIRST and cannot be
+// overridden by ALLOW_SEED — a single env opt-in is too weak a guard for planting
+// known-credential login accounts in prod.
+{
+  const dbHost = (() => {
+    try {
+      return new URL(process.env.DATABASE_URL ?? '').host || 'unknown';
+    } catch {
+      return 'unknown';
+    }
+  })();
+
+  // Required refusal: never seed when running in a production environment.
+  if (process.env.NODE_ENV === 'production') {
+    console.error(
+      'Refusing to seed: NODE_ENV=production.\n' +
+        'seed-demo.ts creates ~10 demo owner accounts with the public password "Demo1234!".\n' +
+        'Demo data must NEVER be seeded into production under any circumstances.\n' +
+        'This refusal is absolute and cannot be overridden with ALLOW_SEED.\n' +
+        `Target database host: ${dbHost}`,
+    );
+    process.exit(1);
+  }
+
+  // Belt-and-suspenders: also refuse if DATABASE_URL points at the known production DB host,
+  // even if NODE_ENV was left unset. Production Postgres lives on DigitalOcean managed DBs.
+  if (dbHost.endsWith('.db.ondigitalocean.com')) {
+    console.error(
+      `Refusing to seed: DATABASE_URL host "${dbHost}" is the production database.\n` +
+        'seed-demo.ts plants known-credential demo accounts and must never touch production.\n' +
+        'This refusal cannot be overridden with ALLOW_SEED.',
+    );
+    process.exit(1);
+  }
+}
+
+// Require an explicit opt-in so it can never run by accident (second gate, non-production only).
 if (process.env.ALLOW_SEED !== '1') {
   const host = (() => {
     try {