Production hardening: security, UI, docs, logging, deployment

[HeadyMe]

Summary

• Localhost contamination removed — startup logging no longer prints localhost URLs; uses structured JSON logging with configured BASE_URL
• Security headers added — X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, HSTS (production)
• CORS hardened — env-driven ALLOWED_ORIGINS replaces open-by-default behavior
• Landing page rebuilt — full production page with navigation, features grid, ecosystem links, call-to-action buttons
• Routes added — /docs (full documentation with config, architecture, API, deployment, troubleshooting), /services (ecosystem directory), styled 404 handler
• Structured logging — JSON output in production, human-readable in development
• Graceful shutdown — SIGTERM/SIGINT handling with 10s timeout for container orchestrators
• Port mismatch fixed — default aligned to 8080 (was 3000 in code vs 8080 in Dockerfile)
• Dockerfile improved — multi-stage build for smaller images + HEALTHCHECK instruction
• CI enhanced — PR trigger added, route verification step tests all 4 endpoints
• README overhauled — config table, routes table, architecture, deployment, ecosystem map, troubleshooting

Test plan

• npm test passes
• GET /health returns 200 with JSON status
• GET / returns full landing page with nav, features, ecosystem
• GET /docs returns documentation page
• GET /services returns ecosystem service directory
• GET /nonexistent returns 404 styled page
• All 5 security headers present on responses
• Graceful shutdown on SIGTERM works correctly
• Docker build and run (requires Docker)
• Cloud Run deployment (requires GCP credentials)

🤖 Generated with Claude Code