fix: harden and clean the public release

[Daxitdon]

Summary

Hardens and cleans the first public Super Proxy release after independent review.

Security and bootstrap

• require a strong SESSION_SECRET before production startup
• remove the predictable development/session fallback from production behavior
• retain process-random ephemeral sessions for local development only
• keep DEV_ADMIN_KEY bootstrap explicit and opt-in
• add focused regression coverage for session and bootstrap behavior

Container and packaging

• use a writable /app/data volume for the non-root runtime user
• require bootstrap secrets in Compose configuration
• include LICENSE and NOTICE in the runtime image
• correct repository metadata and public quickstart documentation
• add container/Compose verification to CI

Public release cleanup

• remove deployment-specific setup bundles and legacy console artifacts
• neutralize internal deployment terminology and attribution
• broaden release scanning to every tracked release file (except generated lock metadata)
• update Security Advisory and Code of Conduct reporting links

Dependency remediation

• refresh compatible transitive lockfile resolutions
• remove the reported critical/high advisories (websocket-driver, @grpc/grpc-js, form-data, protobufjs)
• npm audit: 1 critical + 3 high → 0 critical + 0 high

Verification

• npm run build — pass
• npm test — 591/591 pass
• bash scripts/secret-scan.sh — 154 tracked files, clean
• focused auth tests — 6/6 pass
• integrated Docker/Compose build/start/health smoke — pass
• dashboard / — HTTP 200
• explicit admin bootstrap — HTTP 200
• unauthenticated admin access — HTTP 403
• runtime UID — 10001
• SQLite volume writable; LICENSE and NOTICE present
• git diff --check — pass
• signed commit verified locally

Review

• independent auth/runtime/container reviewer: APPROVE, no blockers
• public release reviewer exercised dashboard, bootstrap, metadata, scan, npm pack, and removed-artifact 404s; no blocking defect was recorded before timeout

Scope

Public Nextbasedev/super-proxy only. No private model-gateway repository or production deployment changes.