Security hardening: headers, scanning, Docker, firewall

- Caddy: HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy,
  Permissions-Policy on all responses
- Caddy: Block scanner paths (.env, .git, wp-config, etc.) with 403
- CI: Gitleaks secret scanning + pnpm audit for vulnerabilities
- Dependabot: Weekly npm + GitHub Actions + monthly Docker updates
- Docker: Non-root user in journal, planner, and brouter containers
- Server: UFW firewall (22/80/443 only) + fail2ban (8 IPs already banned)
- SECURITY.md: Vulnerability disclosure policy
- Privacy page: Security practices section added

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/planner/Dockerfile

@@ -21,6 +21,7 @@ COPY . .
 RUN pnpm --filter @trails-cool/planner build
 
 FROM base AS runtime
+RUN addgroup --system app && adduser --system --ingroup app app
 COPY --from=deps /app/node_modules ./node_modules
 COPY --from=deps /app/apps/planner/node_modules ./apps/planner/node_modules
 COPY --from=build /app/apps/planner/build ./apps/planner/build
@@ -30,6 +31,7 @@ COPY --from=build /app/apps/planner/package.json ./apps/planner/package.json
 COPY --from=build /app/packages ./packages
 
 WORKDIR /app/apps/planner
+USER app
 EXPOSE 3001
 ENV PORT=3001
 CMD ["node", "--experimental-strip-types", "server.ts"]