fix: edge hardening, rootless containers, fail-closed frontend mode

backend/app/main.py

@@ -5,10 +5,12 @@ from contextlib import asynccontextmanager
 from pathlib import Path
 
 from fastapi import FastAPI
+from starlette.middleware.body_limit import RequestBodyLimitMiddleware
 
 from .auth.api import access_router, auth_router
 from .flows.api import approvals_router, flows_router
 from .flows.sync import run_sync_blocking, watch_forever
+from .middleware import RunThrottleMiddleware, SecurityHeadersMiddleware
 from .settings import settings
 
 logger = logging.getLogger(__name__)
@@ -58,12 +60,21 @@ app = FastAPI(
     title="Kirche Einfach API",
     description="KI-gestützte Verwaltungsplattform für Kirche",
     version="0.1.0",
-    docs_url="/api/docs",
-    redoc_url="/api/redoc",
-    openapi_url="/api/openapi.json",
+    # Interactive docs only in debug: /api/docs maps the whole surface.
+    docs_url="/api/docs" if settings.debug else None,
+    redoc_url="/api/redoc" if settings.debug else None,
+    openapi_url="/api/openapi.json" if settings.debug else None,
     lifespan=lifespan,
 )
 
+# TLS terminates at the reverse proxy: uvicorn --proxy-headers (see
+# entrypoint.sh) trusts its forwarding headers so Secure cookies, client
+# IPs (throttle) and absolute URLs are correct. The API is not directly
+# internet-reachable (proxy-only), so trusting them is safe.
+app.add_middleware(RequestBodyLimitMiddleware, max_body_size=settings.max_body_bytes)
+app.add_middleware(RunThrottleMiddleware)
+app.add_middleware(SecurityHeadersMiddleware)
+
 app.include_router(flows_router)
 app.include_router(approvals_router)
 app.include_router(access_router)