security(hardening): CSP, secrets untrack, DB loopback, non-root app, OAuth log redaction, image provenance

[KrishnaSuravarapu]

Summary

Single-PR remediation of the in-repo legs across the open enigma attack-chain tickets (CTO-4890…4897). Per direction, everything actionable in this repo is bundled here; rate-limiting is intentionally excluded — django-axes (AXES_FAILURE_LIMIT=5, lockout) already covers credential-stuffing.

Chains close once all their legs are fixed; this PR advances the code/config legs and the remaining legs (below) are non-code follow-ups.

Changes by chain leg

Chain	Leg fixed here	File(s)
C-002	Add CSP (django-csp) + X-Frame-Options: DENY, nosniff, referrer-policy	settings.py, requirements.txt
C-004	Untrack secrets/*.env (add .sample + .gitignore); bind MySQL & Redis to 127.0.0.1	docker-compose.yml, .gitignore, secrets/
C-001 / C-003	app user gets its own group (not gid 0/root); log file no longer world-writable (chmod 640)	Dockerfile
C-005	Attach SLSA provenance + SBOM to the pushed image (Actions were already SHA-pinned)	docker-push.yml
C-008	Remove social_core.pipeline.debug.debug (logs OAuth tokens/PII); lower app log level DEBUG → INFO; AXES_ONLY_USER_FAILURES=False so lockout is username+IP not username-only — this is C-008's chain-breaker F-032 (CTO-4880), so C-008 (CTO-4897) closes on merge	settings.py

⚠️ Reviewer notes / must-verify

• CSP not render-tested in this environment. 'unsafe-inline' is retained for script/style (16 templates still ship inline <script>), and a CDN allowlist (code.jquery.com, use.fontawesome.com, fonts.googleapis.com/gstatic, cdn.jsdelivr.net) is included. Smoke-test the ops pages render before relying on it; tighten to nonces + drop 'unsafe-inline' as follow-up.
• django-csp==3.8 pinned (uses the classic CSP_* settings, Django 4.2-compatible).

Explicitly NOT in this PR (cannot be code)

• Secret rotation + git-history purge (C-004): the previously-committed secrets/*.env values are still in git history. Untracking does not invalidate them — the exposed credentials (MySQL root password, TOKEN) must be rotated and history purged (BFG/git filter-repo). Ops runbook item.
• Production bind-mount removal (F-017 / C-003): the whole-source bind-mount lives in this dev docker-compose.yml; the real prod fix belongs in the deploy manifests repo. Left as-is to avoid breaking local dev.
• F-022 self-approval IDOR (C-007): left unfixed pending a decision — PR security(authz): mark_revoked requires ALLOW_USER_OFFBOARD not read perm (F-006, CTO-4858) #317 showed the proposed fix would break legitimate module-specific approvers. C-007's race/autoretry legs are already fixed (security(races): serialize approval transitions with select_for_update + idempotency guard (F-027/028/029) #321).
• Password-history validator (C-008): needs a new validator + history model; out of scope for the OAuth-primary login flow here.

🤖 Generated with Claude Code