Шхуна не тонет: security, infra и доки на русском.

Безопасность довёл до ума — Cursor-генерацию переписал руками.
IDOR закрыл, CSRF задушил, refresh rotation теперь как надо.
HSTS на staging, ENABLE_DOCS=false, install.env recovery протестил.

Backend:
- jwt_denylist + auth_epoch: мгновенный revoke access JWT (logout/block/reset)
- auth/admin/users: bump epoch, logout с Bearer, forgot_password skip для blocked
- install_secrets: путь всегда apps/api/data/secrets/ (bootstrap из корня не ломает Docker)
- seed: SEED_DEMO_USERS=false на prod/staging
- тесты: jwt revoke, integration, coverage gate 90%

Frontend:
- logout шлёт Bearer, обработка TOKEN_REVOKED
- guards TypeScript fix
- E2E: blocked user → 401 сразу после block

Infra:
- staging/prod compose, TLS nginx, deploy-скрипты
- k6 §17.2, backup/health/smoke scripts

Docs:
- docs/ на русском: project, security, deploy, release (старые md слили)
- README короткий + план ТЗ + стандартные логины dev

Код готов к плаванию. Капитан может идти писать фронт.

infra/docker/docker-compose.staging.yml

@@ -1,9 +1,83 @@
+# Staging stack — VPS deploy (no bind mounts, production-like settings).
+# Usage:
+#   cp infra/docker/.env.staging.example infra/docker/.env.staging
+#   docker compose -f infra/docker/docker-compose.staging.yml --env-file infra/docker/.env.staging up -d --build
+
 services:
-  web:
-    image: compton/web:staging
+  postgres:
+    image: postgres:16
+    restart: unless-stopped
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+    volumes:
+      - staging_postgres_data:/var/lib/postgresql/data
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+
+  minio:
+    image: minio/minio
+    restart: unless-stopped
+    command: server /data --console-address ":9001"
+    env_file:
+      - ../../apps/api/data/secrets/install.env
+    volumes:
+      - staging_minio_data:/data
+
   api:
-    image: compton/api:staging
+    build:
+      context: ../../apps/api
+      dockerfile: Dockerfile
+    restart: unless-stopped
+    environment:
+      APP_ENV: staging
+      ENABLE_DOCS: "false"
+      ENABLE_TEST_ROUTES: "false"
+      COOKIE_SECURE: "true"
+      ENABLE_RATE_LIMIT: "true"
+      EMAIL_DELIVERY_MODE: smtp
+      STORAGE_MODE: s3
+      S3_ENDPOINT: http://minio:9000
+      REDIS_URL: redis://redis:6379/0
+      SEED_DEMO_USERS: "false"
+    env_file:
+      - ../../apps/api/.env.example
+      - ../../apps/api/data/secrets/install.env
+      - .env.staging
+    volumes:
+      - ../../apps/api/data/secrets:/app/data/secrets
+      - staging_api_logs:/app/data/logs
+    depends_on:
+      - postgres
+      - redis
+      - minio
+
+  web:
+    build:
+      context: ../..
+      dockerfile: apps/web/Dockerfile
+    restart: unless-stopped
+    environment:
+      VITE_USE_API_PROXY: "true"
+      VITE_API_URL: http://api:8000
+    depends_on:
+      - api
+
   nginx:
     image: nginx:stable-alpine
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
     volumes:
-      - ../nginx/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ../nginx/default.tls.conf:/etc/nginx/conf.d/default.conf:ro
+      - ${TLS_CERT_DIR:-./certs}:/etc/nginx/certs:ro
+    depends_on:
+      - web
+      - api
+
+volumes:
+  staging_postgres_data:
+  staging_minio_data:
+  staging_api_logs: