feat(api): production security, cors hardening, latency optimizations, postman artifacts & frontend documentation

ai-patient-onboarding/production_security_checklist.md

@@ -0,0 +1,22 @@
+# Production Security & Compliance Checklist
+
+## 1. Authentication & Authorization Controls
+- [x] **Bearer Token & API Key Authentication**: Verified (`app/core/security.py`).
+- [x] **IDOR Session Ownership Validation**: Verified (`session.patient_id == auth.patient_id`).
+- [x] **Unauthenticated Access Prevention**: Unauthenticated requests return `401 Unauthorized`.
+- [x] **Unauthorized Session Modification Prevention**: Cross-patient requests return `403 Forbidden`.
+
+## 2. Input Validation & Schema Boundaries
+- [x] **Numeric Age Validation Bounds**: Enforced `ge=0, le=120` in `PatientContext` schema (`422` returned on invalid inputs).
+- [x] **String & XSS Sanitization**: HTML tags stripped/escaped from initial greetings.
+- [x] **File Upload Restrictions**: 10MB size limit and strict MIME validation (`JPEG`, `PNG`, `WEBP`, `PDF`).
+
+## 3. Network & Transport Security
+- [x] **CORS Configuration**: Wildcard origin (`*`) removed; explicit domain origins configured.
+- [x] **HTTP Security Headers**: `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin` attached.
+- [x] **Rate Limiting**: IP-based rate limiting enforced on API endpoints (`429 Too Many Requests` returned with `Retry-After`).
+
+## 4. Operational & Container Security
+- [x] **Non-Root Container**: Dockerfile configured with dedicated `appuser` (UID 999).
+- [x] **Request ID Tracking**: Attached `X-Request-ID` correlation header to all HTTP requests.
+- [x] **Error Masking**: Stack traces hidden behind generic `500 Internal Server Error` responses.