Caddy пишет access log под UID 0; контейнер с USER nobody (65534)
не может открыть файл → ни один auth event не пересылался (GlitchTip issue #71).
Удалён USER nobody из Dockerfile — форвардер запускается под root.
Security: caddy_logs mount read-only, нет network listener, нет shell.
auth_forwarder_state — write-only форвардера, не shared с другими сервисами.
Добавлен throttle на capture_exception: не более 1 Sentry event в 5 минут
при persistent ошибке (деque-паттерн как у basic_auth_storm).
- backend/alembic/* — alembic infra (env.py, script.py.mako). versions/ empty
for now; first migration goes in Stage 2a when models are finalized.
- backend/Dockerfile: bake alembic.ini + alembic/ into the image so
`docker compose exec backend alembic upgrade head` works in prod.
- backend/db/init/99_drop_unused_extensions.sql + bind-mount in both compose
files: drops postgis-image's TIGER/topology/fuzzystrmatch on fresh volumes.
- .pre-commit-config.yaml + pre-commit in dev deps: ruff/prettier on commit
to stop CI failures like UP035 from leaking out.
- ops/backup.sh, ops/restore.sh: pg_dump cron script with optional Selectel S3
upload. 7-day local retention. Restore guard: requires RESTORE_CONFIRM=yes.
- Makefile: new targets `make migration NAME=...`, `make pre-commit-install`.
- backend/.env.example: SENTRY_DSN comment with sentry.io reference.
