feat: phase 6 production hardening + DB-to-DB transfer

Security:
- Graceful shutdown: http.Server + signal.NotifyContext, 10s drain,
  retention sweeper cancelled before pool close
- Scoped API keys (migration 00006): ingest/read/write/admin enforced in
  auth middleware; scope picker + badges in Settings UI; scopeless legacy
  keys act as admin. Read-only keys now get 403 on ingest (verified live)
- nginx: baseline security headers on all responses, CSP scoped to SPA;
  fixed add_header inheritance shadowing
- better-auth rate limit enabled unconditionally (was gated on NODE_ENV,
  which the shipped .env sets to development)
- Mailpit moved to docker-compose.dev.yml; prod compose cannot expose it
- setup.sh generates PRIMORA_ENCRYPTION_KEY

Reliability/ops:
- Retention: per-project retention_{events,audit,webhook}_days
  (migration 00007, 0=off) + hourly RetentionSweeper; edit UI in Projects
- GET /api/v1/metrics Prometheus exposition
- compose: healthchecks + restart policies everywhere, dragonfly pinned
  to v2.0.0, depends_on service_healthy
- backup.sh/restore.sh (pg_dump -Fc + storage volume); restore verified
  against scratch postgres+volume
- .dockerignore: exclude target dirs (build context was 4.7GB)

Correctness/testing:
- DBX transfer endpoint: POST /db-connections/:id/transfer — SQL or Redis
  target, 1000-row bound, server-side creds (verified live pg→dragonfly)
- Pagination audit: ListComponents capped at 500 (auto-registers)
- CI: goose up/reset/up job + compose e2e-smoke job (smoke-e2e.sh
  verified locally: signup, bootstrap, scoped keys, ingest, metrics)
- k6 load sanity script: 6650 reqs, ~217/s, 0 real failures, p95 221ms
  (429s = configured rate limiter working)

Docs: DEPLOYMENT_GUIDE.md, PRODUCTION_READINESS.md; verify script
repaired (stale refs + set -e arithmetic abort). ROADMAP: phase 2 +
phase 6 marked complete.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

scripts/smoke-e2e.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+# End-to-end smoke test against a running Primora stack.
+# Expects the compose stack on BASE_URL (nginx :80 by default).
+#
+#   ./scripts/smoke-e2e.sh
+#   BASE_URL=http://localhost:8080 ./scripts/smoke-e2e.sh
+#
+# Covers: health, signup/login, bootstrap, scoped API keys, ingest,
+# telemetry read, and the Prometheus endpoint. Exits non-zero on failure.
+
+set -euo pipefail
+
+BASE="${BASE_URL:-http://localhost}"
+EMAIL="smoke-$(date +%s)@example.com"
+PASSWORD="smoke-password-$(date +%s)"
+JAR="$(mktemp)"
+trap 'rm -f "$JAR"' EXIT
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+step() { echo "==> $*"; }
+
+wait_for() {
+  local url="$1" name="$2" tries=60
+  while (( tries-- > 0 )); do
+    if curl -fsS -o /dev/null "$url" 2>/dev/null; then
+      echo "    $name ready"
+      return 0
+    fi
+    sleep 2
+  done
+  fail "$name did not become ready ($url)"
+}
+
+step "waiting for services"
+wait_for "$BASE/api/v1/health/liveness" "backend liveness"
+wait_for "$BASE/api/v1/health/readiness" "backend readiness"
+wait_for "$BASE/auth-health" "auth"
+
+step "signup $EMAIL"
+code=$(curl -sS -o /dev/null -w '%{http_code}' -c "$JAR" \
+  -H 'content-type: application/json' \
+  -d "{\"email\":\"$EMAIL\",\"password\":\"$PASSWORD\",\"name\":\"Smoke Test\"}" \
+  "$BASE/auth/sign-up/email")
+[ "$code" = "200" ] || [ "$code" = "201" ] || fail "sign-up returned $code"
+
+step "fetch api token"
+token=$(curl -fsS -b "$JAR" "$BASE/auth/token" | sed -n 's/.*"token":"\([^"]*\)".*/\1/p')
+[ -n "$token" ] || fail "no token in /auth/token response"
+
+step "bootstrap organization + project"
+code=$(curl -sS -o /tmp/smoke-bootstrap.json -w '%{http_code}' -H "authorization: Bearer $token" -H 'content-type: application/json' \
+  -d '{"organizationName":"Smoke Org","organizationSlug":"smoke-org","projectName":"Smoke Project","projectSlug":"smoke-project"}' \
+  "$BASE/api/v1/bootstrap")
+if [ "$code" = "409" ]; then
+  # Instance already bootstrapped — create a fresh org + project for this user.
+  org_id=$(curl -fsS -H "authorization: Bearer $token" -H 'content-type: application/json' \
+    -d "{\"name\":\"Smoke Org $(date +%s)\",\"slug\":\"smoke-$(date +%s)\"}" \
+    "$BASE/api/v1/organizations" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
+  [ -n "$org_id" ] || fail "could not create organization"
+  project_id=$(curl -fsS -H "authorization: Bearer $token" -H 'content-type: application/json' \
+    -d "{\"name\":\"Smoke Project\",\"slug\":\"smoke-$(date +%s)-p\"}" \
+    "$BASE/api/v1/organizations/$org_id/projects" | sed -n 's/.*"id":"\([^"]*\)".*/\1/p')
+else
+  [ "$code" = "200" ] || [ "$code" = "201" ] || { cat /tmp/smoke-bootstrap.json >&2; fail "bootstrap returned $code"; }
+  project_id=$(sed -n 's/.*"project_id":"\([^"]*\)".*/\1/p' /tmp/smoke-bootstrap.json)
+fi
+[ -n "$project_id" ] || fail "no project_id available"
+echo "    project $project_id"
+
+step "create ingest+read API key"
+key_json=$(curl -fsS -H "authorization: Bearer $token" -H 'content-type: application/json' \
+  -d '{"name":"smoke-ingest","scopes":["ingest","read"]}' \
+  "$BASE/api/v1/projects/$project_id/api-keys")
+api_key=$(echo "$key_json" | sed -n 's/.*"secret":"\([^"]*\)".*/\1/p')
+[ -n "$api_key" ] || fail "no secret in api key response"
+echo "$key_json" | grep -q '"ingest"' || fail "scopes missing from api key response"
+
+step "ingest event via X-Primora-Key"
+curl -fsS -o /dev/null -H "X-Primora-Key: $api_key" -H 'content-type: application/json' \
+  -d '{"events":[{"type":"metric","severity":"info","component":"smoke","message":"smoke metric","payload":{"name":"smoke.count","value":1}}]}' \
+  "$BASE/api/v1/ingest"
+
+step "negative: read-only key cannot ingest"
+ro_json=$(curl -fsS -H "authorization: Bearer $token" -H 'content-type: application/json' \
+  -d '{"name":"smoke-readonly","scopes":["read"]}' \
+  "$BASE/api/v1/projects/$project_id/api-keys")
+ro_key=$(echo "$ro_json" | sed -n 's/.*"secret":"\([^"]*\)".*/\1/p')
+code=$(curl -sS -o /dev/null -w '%{http_code}' -H "X-Primora-Key: $ro_key" -H 'content-type: application/json' \
+  -d '{"type":"metric","severity":"info","message":"should be rejected"}' \
+  "$BASE/api/v1/ingest")
+[ "$code" = "403" ] || fail "read-only key ingest returned $code, expected 403"
+
+step "read back events"
+curl -fsS -o /dev/null -H "authorization: Bearer $token" \
+  "$BASE/api/v1/projects/$project_id/events?limit=5"
+
+step "prometheus metrics"
+curl -fsS "$BASE/api/v1/metrics" | grep -q 'primora_http_requests_total' \
+  || fail "metrics endpoint missing primora_http_requests_total"
+
+echo
+echo "smoke: all checks passed"