Security audit: fix 25 findings across API, nginx, and Docker

Addresses data exposure, access control, input validation, infrastructure
hardening, and supply chain security issues identified during audit.

Key changes:
- Strip internal fields from public campaign/profile/comment endpoints
- Restrict docs routes to CONTENT_ROLES, provisioning to SUPER_ADMIN
- Add SSE connection limits, social middleware fail-closed behavior
- Bind all non-nginx ports to 127.0.0.1, pin container image versions
- Add CSP header, conditional HSTS, token redaction in nginx logs
- Validate nav URLs, calendar schemas, video tracking batch events
- Reject default admin password placeholder, add SSRF protocol checks
- Exclude .env from Code Server, enforce RC admin password in compose
- Add Zod validation for achievement grant/revoke, webhook secret header
- Fix path traversal prefix attack, add calendar token expiry

Bunker Admin

nginx/nginx.conf

@@ -10,7 +10,14 @@ http {
     include /etc/nginx/mime.types;
     default_type application/octet-stream;
 
-    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+    # Redact sensitive query parameters (token, secret) from access logs
+    map $request_uri $redacted_request {
+        ~^(?P<path>[^?]*)\?(?P<args>.*token=[^&]*)  "$path?<token-redacted>";
+        ~^(?P<path>[^?]*)\?(?P<args>.*secret=[^&]*) "$path?<secret-redacted>";
+        default                                       $request_uri;
+    }
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request_method $redacted_request $server_protocol" '
                     '$status $body_bytes_sent "$http_referer" '
                     '"$http_user_agent" "$http_x_forwarded_for"';
 
@@ -32,11 +39,17 @@ http {
     gzip_comp_level 6;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript image/svg+xml;
 
+    # Only send HSTS when the request arrived over HTTPS (via Pangolin tunnel)
+    map $http_x_forwarded_proto $hsts_header {
+        https  "max-age=31536000; includeSubDomains";
+        default "";
+    }
+
     # Security headers (applied globally — X-Frame-Options set per server block)
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-XSS-Protection "1; mode=block" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header Strict-Transport-Security $hsts_header always;
     add_header Permissions-Policy "geolocation=(self), microphone=(), camera=()" always;
 
     # Docker internal DNS — enables runtime resolution so nginx starts