fix(compose): forward INTERNAL_API_SECRET to prod mcp-server + CORS/SSH/LOG levers to prod backend (#722)

[AndriiPasternak31]

Summary

Closes the two remaining prod packaging-gap findings from #722's /validate-config report. There is no env_file: in either compose, so a var forwarded in docker-compose.yml but absent from docker-compose.prod.yml is a dead lever in prod — the missing environment: entry never reaches the container.

3 of the 5 original findings were already fixed (GOOGLE_API_KEY, FRONTEND_URL dup, TRINITY_DATA_PATH); this PR addresses the 2 that remained, plus a zero-behavior-change frontend cleanup surfaced during review.

What changed

File / block	Change
docker-compose.prod.yml — mcp-server	+ INTERNAL_API_SECRET=${INTERNAL_API_SECRET} (no default, matches backend/scheduler prod style)
docker-compose.prod.yml — backend	+ EXTRA_CORS_ORIGINS, + SSH_HOST, + LOG_ARCHIVE_ENABLED / LOG_RETENTION_DAYS / LOG_CLEANUP_HOUR (mirror dev)
src/frontend/src/components/HostTelemetry.vue	Drop dead import.meta.env.VITE_API_BASE ref → API_BASE = ''

Corrected failure mode (Finding 1)

The original "every audit 401s" framing was wrong. The prod mcp-server lacked INTERNAL_API_SECRET, so src/mcp-server/src/audit.ts postAudit hits if (!INTERNAL_SECRET) return; and never POSTs → all MCP tool-call audit (SEC-001) is silently dropped in prod (no request, so no 401). Backend + scheduler already receive the secret in prod, so forwarding it to mcp-server makes both ends share the same value (routers/internal.py returns 403 only on a mismatch).

Design notes

• LOG_ARCHIVE_PATH is intentionally omitted — the code default /data/archives (routers/logs.py, archive_storage.py) already lands in the TRINITY_DATA_PATH bind mount (/data), so no new volume is needed.
• HostTelemetry: VITE_API_BASE was never set anywhere, so API_BASE was always ''; the single Axios client (api.js) uses baseURL: '' (relative, same-origin). The naive "point it at VITE_API_URL" fix would be a regression (VITE_API_URL build-defaults to http://localhost:8000). Not routed through api.js to preserve the 3s timeout / no 401-redirect / raw-fetch response shape (deferred as an Invariant-security: Fix token logging and add HTML reports to gitignore #7 follow-up).

Verification

• ✅ docker compose -f docker-compose.prod.yml config and the +enterprise overlay render clean
• ✅ JSON-resolution proof: all 6 vars resolve into the correct service blocks (no cross-block leak; LOG_ARCHIVE_PATH absent; backend/scheduler INTERNAL_API_SECRET untouched)
• ✅ vite build passes
• ⏳ Live sibling-stack functional audit-row proof (baseline no-row → post-fix source='mcp' row + 200) not run in this PR — the mechanism is proven at the compose layer (audit.ts/internal.py unchanged)

Deferred follow-ups (flagged, not dropped)

• Bucket-C documentation pass (SLACK_APP_TOKEN, TRUSTED_PROXIES, REDIS_STREAM_MAXLEN, etc.) — inert without compose-forwarding too; do compose + docs together in a dedicated issue
• ADMIN_USERNAME → prod (needs mcp-server TRINITY_USERNAME default alignment)
• Fail-loud INTERNAL_API_SECRET (${VAR:?}, Config Validation: 5 critical config issues found (TRINITY_PASSWORD P0, 4x undocumented vars) #692 pattern)
• HostTelemetry → api.js refactor (Invariant security: Fix token logging and add HTML reports to gitignore #7)
• Dead-var cleanup (VITE_API_URL build arg)

Fixes #722

🤖 Generated with Claude Code