Harden production deploys: config split with boot assertions, admin bootstrap, security headers, error masking

wrangler.jsonc is now the prod config and vite.config.ts applies dev overrides in place, which also fixes dev
binding the prod Artifacts namespace alongside stig-dev. A deployed worker refuses to serve when PUBLIC_URL,
USERCONTENT_ORIGIN, SECRETS_KEY or shard bindings are unsafe; deploy:check catches placeholder ids. The first
admin comes from ADMIN_EMAIL (on verification) or BOOTSTRAP_TOKEN, never just the first signup outside dev.
(DEPLOY-P1..P9, AUTH-P5, GIT-P2/P3/P8)

taigrrcommitted 9 days agoparent ed881e4a76edcaeca764851a3934034cd813c1fefcfc6baBrowse files