fix(api): block open redirects, add health check and body limits, run as non-root

- safeReturnTo resolves the target against a placeholder origin and rejects
  backslashes and control characters, so `/\evil.example` and similar
  payloads can no longer redirect off-site after sign-in.
- Add a real unauthenticated /api/health and answer unknown /api/* paths
  with a JSON 404 instead of the SPA shell.
- Limit request bodies: 16 KB for /api/auth/* (read before a session
  exists), 128 MB for resource create/update and uploads, 10 MB elsewhere.
- Run the production image as an unprivileged user and add a Docker
  HEALTHCHECK against /api/health.

docker/Dockerfile

@@ -23,7 +23,9 @@ RUN bun build --compile --minify src/index.ts --outfile server
 
 # Stage 3 — minimal runtime (no bun, no node_modules)
 FROM alpine:3
-RUN apk add --no-cache ca-certificates libstdc++
+RUN apk add --no-cache ca-certificates libstdc++ \
+    && addgroup -S -g 10001 thecloud \
+    && adduser -S -D -H -u 10001 -G thecloud thecloud
 WORKDIR /app
 COPY --from=api-build /app/server ./server
 COPY --from=frontend-build /app/packages/frontend/dist ./public
@@ -33,4 +35,7 @@ COPY svgAsset/authentik.svg ./public/authentik.svg
 COPY aws-icons-svg ./public/aws-icons
 ENV PORT=4500
 EXPOSE 4500
+USER thecloud
+HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
+    CMD wget -q -O /dev/null "http://127.0.0.1:${PORT:-4500}/api/health" || exit 1
 CMD ["./server"]