Patch React2Shell RCE and harden auth, uploads and containers

- Upgrade next 16.0.3 -> 16.3.5 and react/react-dom 19.2.0 -> 19.3.0
  (CVE-2025-55182 / CVE-2025-66478 unauthenticated RCE), next-auth -> 4.24.15
- Require admin role on /api/users, /api/courses and /api/enrollments,
  which were unauthenticated
- Replace ALLOWED_ADMINS checks that allowed any signed-in user when the
  variable was empty with the role-based requireAdmin
- Sanitize upload filenames, restrict thumbnail extensions, store edited
  thumbnails in UPLOADS_DIR, tighten traversal checks in file routes
- Dockerfile: Node 22, pinned pnpm, non-root user, critical audit gate
- Compose: read-only rootfs, dropped caps, no-new-privileges, Postgres
  password from env
- Exclude .env from Docker build context; add security headers
- Deploy with git reset --hard instead of git pull
- Remove stale package-lock.json

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.yml

@@ -9,36 +9,51 @@ services:
     restart: unless-stopped
     ports:
       - "3000:3000"
-    
+
+    # Hardening: the app can't modify its own files, gain privileges, or use
+    # Linux capabilities. Only /tmp, the Next.js cache and /uploads are writable.
+    read_only: true
+    tmpfs:
+      - /tmp
+      - /app/.next/cache:uid=1000,gid=1000
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
     # Environment variables required for production
     environment:
       # Database connection (must match PostgreSQL service)
-      DATABASE_URL: postgresql://cms_user:changeme@postgres:5432/cms_db
-      
+      DATABASE_URL: postgresql://cms_user:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/cms_db
+
       # NextAuth configuration
       NEXTAUTH_URL: http://localhost:3000  # Update to your production domain
       NEXTAUTH_SECRET: ${NEXTAUTH_SECRET}  # Set via .env file
-      
+
       # Google OAuth (from .env)
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID}
       GOOGLE_CLIENT_SECRET: ${GOOGLE_CLIENT_SECRET}
-      
+
       # Admin email whitelist (comma-separated)
       ALLOWED_ADMINS: ${ALLOWED_ADMINS:-admin@university.edu}
-      
+
+      # Shared secret for the remote transcoder API
+      TRANSCODER_SECRET: ${TRANSCODER_SECRET}
+
       # Upload directory (external to Next.js public folder)
       UPLOADS_DIR: /uploads
-    
+
     # Mounted volumes for persistent data
     volumes:
       # Mount uploads directory as bind mount for real-time file sync
+      # Must be writable by uid 1000: chown -R 1000:1000 /mnt/lab/configs/owicms/uploads
       - /mnt/lab/configs/owicms/uploads:/uploads
-    
+
     # Wait for database to be ready before starting
     depends_on:
       postgres:
         condition: service_healthy
-    
+
     # Health check
     healthcheck:
       test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000"]
@@ -51,16 +66,20 @@ services:
     image: postgres:16-alpine
     container_name: college-postgres
     restart: unless-stopped
-    
+    security_opt:
+      - no-new-privileges:true
+
     environment:
       POSTGRES_USER: cms_user
-      POSTGRES_PASSWORD: changeme  # Change in production!
+      # Only applied when the data volume is first created. To change the
+      # password of an existing database, also run ALTER USER cms_user PASSWORD '...'
+      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}
       POSTGRES_DB: cms_db
-    
+
     # Mounted volume for database persistence
     volumes:
       - postgres_data:/var/lib/postgresql/data
-    
+
     # Health check
     healthcheck:
       test: ["CMD-SHELL", "pg_isready -U cms_user"]
@@ -74,28 +93,32 @@ services:
       dockerfile: Dockerfile.transcoder
     container_name: college-transcoder
     restart: on-failure
-    
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
     # Environment variables
     environment:
       # Database connection (must match PostgreSQL service)
-      DATABASE_URL: postgresql://cms_user:changeme@postgres:5432/cms_db
-      
+      DATABASE_URL: postgresql://cms_user:${POSTGRES_PASSWORD:?Set POSTGRES_PASSWORD in .env}@postgres:5432/cms_db
+
       # Transcoder configuration
       UPLOADS_DIR: /uploads
       NODE_ENV: production
-    
+
     # Mounted volumes for access to uploads
     volumes:
       # Mount uploads directory using bind mount for real-time file sync
       - /mnt/lab/configs/owicms/uploads:/uploads
-    
+
     # Wait for database and CMS to be ready
     depends_on:
       postgres:
         condition: service_healthy
       cms:
         condition: service_healthy
-    
+
     # Note: This transcoder runs as a batch job.
     # It processes all 'uploaded' videos and exits.
     # With restart: on-failure, it will restart and process new videos.