Storage→Spaces, security hardening, production-blocker fixes, tests + CI

Storage
- Migrate document/media storage from local disk to DigitalOcean Spaces (S3);
  lib/storage.ts now streams via the S3 SDK; SPACES_* env vars required.
- Add scripts/migrate-storage-to-spaces.ts (idempotent, one-time).

Security hardening (all report findings)
- DB pool fails closed in production when the CA cert is missing (no more
  silent unverified TLS); warns in dev.
- trustProxy: 1 (was true) so X-Forwarded-For can't be spoofed to evade rate limits.
- Login lockout keyed by (email, ip) so an attacker can't lock out a victim.
- Superadmin auto-grant now requires a verified email.
- CSRF tokens HMAC-signed; exact-path exemptions; logout no longer exempt.
- Upload content-sniffing (magic bytes) rejects spoofed MIME types.
- create-admin.ts reads creds from env/argv; seed-demo.ts guarded behind ALLOW_SEED.

Production-blocker fixes
- SPA deep-link/refresh no longer 500s (decorateReply fix); index.html served no-cache.
- Invoice numbering is transaction-safe (per-firm advisory lock + max sequence),
  eliminating concurrent collisions and delete-reuse — no schema change.
- Checkout guards against double-billing a firm already on a paid plan.
- Fix render-loop in CreateInvoiceDrawer / ManualEntryDrawer (unstable effect deps).

Honesty / trust
- Remove fabricated testimonials, stats, strikethrough "was" prices, contact SLA,
  and the login-panel stats; replace with non-fabricated copy.
- Fix cookie-policy consent-key mismatch. (Legal pages still need lawyer review.)

Quality
- Add Vitest unit tests (file-signature, password hashing) and GitHub Actions CI.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/src/server.ts

@@ -36,14 +36,17 @@ export async function buildServer() {
     logger: isProd
       ? { level: 'info' }
       : { level: 'debug', transport: { target: 'pino-pretty', options: { colorize: true } } },
-    trustProxy: true,
+    // Trust exactly ONE proxy hop (the Plesk/nginx reverse proxy in front of Passenger).
+    // `true` would trust the entire X-Forwarded-For chain, letting any client spoof req.ip and
+    // evade the IP-keyed rate limits (including auth brute-force protection).
+    trustProxy: 1,
     bodyLimit: 5 * 1024 * 1024,
   });
 
   // Register the global error handler EARLY so it wins over plugin-default handlers and
   // catches ZodErrors thrown by .parse() inside route handlers.
   app.setErrorHandler((err, req, reply) => {
-    if (err instanceof ZodError || (err as { validation?: unknown }).validation || err.name === 'ZodError') {
+    if (err instanceof ZodError || (err as { validation?: unknown }).validation || (err as Error).name === 'ZodError') {
       req.log.info({ err }, 'validation error');
       return reply
         .code(400)
@@ -123,15 +126,23 @@ export async function buildServer() {
       cacheControl: true,
       maxAge: '1y',
       immutable: true,
-      decorateReply: false,
+      // Must NOT be `false`: the SPA fallback below calls reply.sendFile, which only exists when
+      // @fastify/static decorates the reply. With it disabled, every deep-link/refresh to a
+      // non-/api route (e.g. /dashboard, emailed /reset-password links) 500s in production.
     });
 
-    // SPA fallback: any non-/api path returns index.html
+    // SPA fallback: any non-/api path returns index.html. index.html itself must not be cached
+    // for a year (unlike the hashed assets) or clients keep a stale app shell after each deploy.
     app.setNotFoundHandler((req, reply) => {
       if (req.raw.url?.startsWith('/api/')) {
         return reply.code(404).send({ error: 'not_found' });
       }
-      return reply.type('text/html').sendFile('index.html', webDist);
+      // cacheControl:false stops @fastify/static from stamping its own 1y immutable header
+      // (which would otherwise override the no-cache below and pin a stale app shell).
+      return reply
+        .header('Cache-Control', 'no-cache')
+        .type('text/html')
+        .sendFile('index.html', webDist, { cacheControl: false });
     });
   } else {
     app.log.warn({ webDist }, 'web/dist not found — SPA assets will not be served');