- safeReturnTo resolves the target against a placeholder origin and rejects
backslashes and control characters, so `/\evil.example` and similar
payloads can no longer redirect off-site after sign-in.
- Add a real unauthenticated /api/health and answer unknown /api/* paths
with a JSON 404 instead of the SPA shell.
- Limit request bodies: 16 KB for /api/auth/* (read before a session
exists), 128 MB for resource create/update and uploads, 10 MB elsewhere.
- Run the production image as an unprivileged user and add a Docker
HEALTHCHECK against /api/health.
Zakaria