Enforce strict runtime secrets, add env loader, and make DB setup explicit

[ehsanking]

Motivation

• Harden production startup by refusing weak or placeholder secrets and making required credentials explicit.
• Support an explicit env-file policy (local vs docker-compose) and deterministic precedence for loading environment values.
• Replace implicit DB auto-detection with clear, explicit workflows for local init and production migrations to avoid accidental schema drift.

Description

• Introduces an env loader lib/env-loader.ts and applies a policy (.env.local for local-dev, .env for docker-compose) with precedence process.env > primary > secondary and helper loadEnvWithPolicy.
• Adds strict runtime validations in lib/env-security.ts and docker-entrypoint.sh to fail fast in production when secrets are missing, too short, placeholder-like, or obviously default.
• Updates docker-compose.yml to require critical vars at container start (uses :${VAR:?message}) and removes dangerous default credentials.
• Reworks secret bootstrapping in lib/setup-secrets.ts to write generated values to the active env file based on policy and to generate VAPID keys; README and .env.example were updated to surface the new policy and placeholders.
• Makes DB setup explicit: scripts/db-setup.ts now accepts init-dev (SQLite bootstrap) or migrate-prod (PostgreSQL migrate deploy) and uses the env loader to resolve DATABASE_URL; package.json scripts were updated accordingly and postinstall now runs prisma generate.
• Improves docker-entrypoint.sh to use a stricter validator, fail fast on missing prisma CLI or failed migrations in production, and provide clearer logging and error handling.

Testing

• Ran lint via npm run lint and static checks, which passed.
• Ran unit tests with npm test (Vitest) against the modified modules, which passed.
• Exercised DB workflows manually via the new scripts: npm run db:init:dev (SQLite path) and npm run db:migrate:prod (Postgres path) in a CI-like environment; both completed the expected steps (schema generation and migration) without errors.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.