Harden application, database, and deployment security

[vezcode]

What changed

• upgrades DOMPurify and React Router past open security advisories and removes all npm audit findings
• removes CI vulnerability bypasses, enables real dependency review and bundle-size gates
• separates Node API and public PostgREST database credentials and networks
• pins container images, adds health checks, a strict Docker build context and GET-only public REST enforcement
• fails closed on missing production Turnstile/Resend configuration and originless browser API calls
• adds withdrawal-data anonymization, updates privacy text and fixes database provisioning/RLS order
• removes 69 obsolete public migrations containing unsafe historical defaults
• adds proprietary licensing, security.txt, CODEOWNERS and deployment commit-race protection

Why

The production review found active dependency advisories, CI exceptions for those advisories, shared database credentials, unnecessary network exposure, a fail-open production configuration, stale public migrations and retention gaps.

Verification

• ESLint and TypeScript passed
• 115 Vitest tests passed
• backend/CSP/SEO script tests passed
• Chromium E2E: 12 passed
• Firefox E2E: 12 passed
• production build and six bundle budgets passed
• root and backend npm audits: 0 vulnerabilities
• Compose YAML, shell syntax, Node syntax and Git whitespace checks passed

Deployment note

Apply deploy/hetzner/migrations/20260809210000_anonymize_withdrawn_newsletter.sql after a verified backup. Configure different API_DATABASE_URL and POSTGREST_DATABASE_URL credentials before removing the documented compatibility fallback.