2 Commits

Include renames

Author	SHA1	Message	Date
MMD	e5d6c77c3c	feat(data-safety): scheduled DB backups + audit trail + verified actor attribution ... - db-backup sidecar: pg_dump -Fc of procurement+casdoor every BACKUP_INTERVAL_SECONDS into BACKUP_DIR, retention via BACKUP_KEEP_DAYS - audit_log table (migration.sql + runtime ensure_audit_table) with model + transactional helper (utils/audit.record) — wired into user create/role-change and inventory transaction creation - get_actor: quote_events.actor now stores the VERIFIED user's display name instead of the raw bearer token	2026-09-18 22:23:34 +03:30
MMD	43e317eeba	chore(security): remove committed secrets/dumps, .env-based config, hardened deploy webhook ... - Delete backups/*.dump and all real credentials from README/docs (prod MinIO creds, Casdoor passwords, server IP, admin password) - All stack secrets now come from git-ignored .env (.env.example added); docker-compose.prod.yml refuses to boot without them (${VAR:?}) - seed_casdoor.py: bcrypt password hashing, generated console/client secrets - Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver + systemd unit + README (replaces unauthenticated deploy endpoint) - docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist	2026-09-18 21:55:24 +03:30