refactor: item 29 cleanup

A10 A11 A12 A13 A14 A15 X10 X11 X12: role check denies outside a request, no API versioning, open-in-view off, no passwords in toString, X-Forwarded-For only from private peers, CORS from APP_FRONTEND_URL, non-root image.

Dockerfile

@@ -36,5 +36,9 @@ EXPOSE 8080
 # Copy the compiled jar file from the builder stage
 COPY --from=builder /app/target/*.jar app.jar
 
+# No root in the container
+RUN addgroup -S app && adduser -S app -G app
+USER app
+
 # Run the application
 ENTRYPOINT ["java", "-jar", "app.jar"]