security: production hardening (seeding, CORS/HSTS, CSP, password policy, HttpOnly refresh cookie, dependabot)

[Akash29g]

Production Security Hardening — harden/prod-security

The app is live on a real domain, so this PR tightens the production security posture. Each item is a self-contained, reviewable commit.

What's included

#	Item	Summary
1	Seeder gating	Reference catalogs seed in all envs; demo tenants/users + startup migration are Development-only (no demo credentials ever reach prod).
3	Swagger	Confirmed gated to IsDevelopment() only.
4	CORS + HSTS	Prod origins locked via appsettings.Production.json; HSTS enabled (1yr, includeSubDomains, preload); forwarded-headers on for nginx TLS termination.
5	CSP	Restrictive Content-Security-Policy on the JSON API (default-src 'none') + a SPA CSP on the nginx layer.
6	Password policy	Min-length + complexity + HaveIBeenPwned k-anonymity breach check on password change; typed HttpClient with a 3s fail-open timeout. Change-password now returns a human-readable rejection reason.
7	Token hardening	Access-token TTL cut to 20 min; refresh token moved out of the JSON body into an HttpOnly / Secure / SameSite=Strict cookie (Path=/api/v1/auth). Angular updated to use withCredentials; CORS already allows credentials.
8	Dependabot	Weekly updates for NuGet, npm (/docanalytics-web), and GitHub Actions.
9	Ops hygiene	Prod log levels tightened (EF SQL/params no longer logged at Information); startup migration Dev-only (prod migrates via the deploy pipeline); verified no secrets are logged.

Dropped

• feat: add auth slice (login, me, sites) — JWT issuance, BCrypt verify, UserSiteAccess join #2 env-driven super-admin bootstrap — decided to seed the platform admin directly instead; not worth the extra machinery.

Testing

• Backend: 213/213 passing; dotnet build -warnaserror:CS1591 clean.
• Frontend: 137/137 passing; ng build clean.
• Manual smoke test: login → refresh cookie present (HttpOnly/Secure/Strict) → silent token refresh via cookie → logout clears cookie. ✅

⚠️ Reviewer notes

• feat: dashboard summary counters + recent-failures #7 is a full-stack change. The refresh token is now cookie-only — the SPA no longer reads/sends it. Frontend uses withCredentials; backend CORS has AllowCredentials().
• Infra follow-ups (out of scope for this PR, console-side): move Jwt__Key / ConnectionStrings__* into Secrets Manager, rotate any keys ever committed, set RDS Publicly accessible = No + SG lockdown, ACM/TLS + HTTP→HTTPS at the ALB/nginx, and a DML-only DB role for the app.