Harden CI and switch release builds to tagged immutable images

docs/threat-model.md

@@ -0,0 +1,36 @@
+# Threat model
+
+## Protected assets
+
+- File contents, metadata, previews, and replacement-recovery blobs.
+- Password, sessions, TOTP secrets, recovery codes, API tokens, share tokens, and OnlyOffice secrets.
+- Database-to-object mapping, backup data, and blob manifests.
+
+## Trust boundaries
+
+- Browser to Nginx Proxy Manager to Drive HTTP service.
+- Drive to PostgreSQL on the private container network.
+- Drive to managed cache/array mounts.
+- Drive to the existing OnlyOffice Document Server.
+- Public-link visitors to explicitly shared resources.
+- Read-only importer mounts to managed Drive storage.
+
+## Primary threats
+
+- Unclaimed-instance takeover before first-run setup.
+- Session theft, CSRF, credential guessing, token leakage, and proxy-address spoofing.
+- Path traversal, symlink following, MIME confusion, malicious previews, and archive expansion.
+- SSRF or forged OnlyOffice callbacks.
+- Stale writes, duplicate requests, interrupted commits, and premature GC.
+- Secret disclosure through logs, images, configuration, backups, or repository history.
+
+## Phase 0 controls
+
+- Production setup must finish before proxy exposure; setup is disabled atomically after owner creation.
+- Secrets are environment/file inputs and ignored by Git.
+- Non-root container, explicit mounts, private PostgreSQL network, and health endpoints.
+- Architectural boundaries prevent HTTP code from reaching database or managed storage directly.
+- Security headers, CSRF, authentication, rate limits, scoped tokens, and callback validation are implemented with their Phase 1 features.
+
+Review this document whenever a new external integration, public endpoint, preview processor, or authentication mechanism is introduced.
+