feat: phase 6 production hardening + DB-to-DB transfer

Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
  retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
  auth middleware; scope picker + badges in Settings UI; scopeless legacy
  keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
  fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
  which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY

Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
  (migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
  to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
  against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)

Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
  target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
  verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
  (429s = configured rate limiter working)

Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

scripts/load-sanity.js

@@ -0,0 +1,75 @@
+// Primora load sanity — NOT a benchmark. Verifies the ingest path and a hot
+// read endpoint hold up under modest concurrency without errors.
+//
+//   k6 run scripts/load-sanity.js \
+//     -e PRIMORA_API_KEY=prm_xxx_xxx \
+//     -e PRIMORA_PROJECT_ID=<uuid> \
+//     -e BASE_URL=http://localhost
+//
+// The key needs the ingest + read scopes. Create one in Settings → API keys.
+
+import http from "k6/http";
+import { check } from "k6";
+
+const BASE = __ENV.BASE_URL || "http://localhost";
+const API_KEY = __ENV.PRIMORA_API_KEY || "";
+const PROJECT = __ENV.PRIMORA_PROJECT_ID || "";
+
+export const options = {
+  scenarios: {
+    ingest: {
+      exec: "ingest",
+      executor: "constant-vus",
+      vus: 5,
+      duration: "30s",
+    },
+    hot_read: {
+      exec: "hotRead",
+      executor: "constant-vus",
+      vus: 10,
+      duration: "30s",
+    },
+  },
+  // 429s are the rate limiter doing its job (API_KEY_RATE_LIMIT_PER_MINUTE,
+  // default 600/min) — counted as expected via responseCallback below. The
+  // sanity bar is: no real errors, no hangs. Raise the env limit or lower
+  // VUs to exercise unthrottled throughput.
+  thresholds: {
+    http_req_failed: ["rate<0.01"],
+    http_req_duration: ["p(95)<500"],
+  },
+};
+
+const ingestBody = JSON.stringify({
+  events: [
+    {
+      type: "metric",
+      severity: "info",
+      component: "load-sanity",
+      message: "k6 sanity metric",
+      payload: { name: "k6.sanity", value: 1 },
+    },
+  ],
+});
+
+export function ingest() {
+  const res = http.post(`${BASE}/api/v1/ingest`, ingestBody, {
+    headers: {
+      "content-type": "application/json",
+      "X-Primora-Key": API_KEY,
+    },
+    responseCallback: http.expectedStatuses(202, 429),
+  });
+  check(res, { "ingest 202 or throttled": (r) => r.status === 202 || r.status === 429 });
+}
+
+export function hotRead() {
+  const res = http.get(
+    `${BASE}/api/v1/projects/${PROJECT}/events?limit=25`,
+    {
+      headers: { "X-Primora-Key": API_KEY },
+      responseCallback: http.expectedStatuses(200, 429),
+    },
+  );
+  check(res, { "events 200 or throttled": (r) => r.status === 200 || r.status === 429 });
+}