fix(security): comprehensive auth and config hardening from audit

.codecov.yml

@@ -0,0 +1,21 @@
+codecov:
+  notify:
+    wait_for_ci: true
+  require_ci_to_pass: true
+comment:
+  behavior: default
+  layout: reach,diff,flags,tree
+  show_carryforward_flags: false
+coverage:
+  precision: 2
+  range:
+  - 60.0
+  - 80.0
+  round: down
+  status:
+    changes: false
+    default_rules:
+      flag_coverage_not_uploaded_behavior: include
+    patch: true
+    project: true
+slack_app: true

.coderabbit.yaml

@@ -0,0 +1,28 @@
+# CodeRabbit configuration
+# https://docs.coderabbit.ai/guides/configure-coderabbit
+
+language: en-US
+early_access: true
+
+reviews:
+  request_changes_workflow: false
+  profile: chill
+  base_branches:
+    - develop
+    - rebuild
+  high_level_summary: true
+  review_status: true
+  commit_messages: true
+  suggested_labels: true
+  poem: false
+  path_filters:
+    - "!**/target/**"
+    - "!**/node_modules/**"
+    - "!**/.nuxt/**"
+    - "!**/.output/**"
+    - "!**/coverage/**"
+    - "!**/dist/**"
+    - "!**/.git/**"
+
+chat:
+  auto_reply: true

.editorconfig

@@ -0,0 +1,32 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.rs]
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false
+
+[*.{yml,yaml}]
+indent_size = 2
+
+# Makefiles require tabs (syntax)
+[Makefile]
+indent_style = tab
+
+# Nix files: prettier handles formatting, allow 2-space indent
+[*.nix]
+indent_style = space
+indent_size = 2
+
+# JSON files: Prettier handles formatting with 2-space indent
+[*.json]
+indent_style = space
+indent_size = 2

.env.example

@@ -0,0 +1,5 @@
+# Drop environment configuration
+# See server/.env.example for full reference
+DATABASE_URL="postgres://drop:drop@127.0.0.1:5432/drop"
+EXTERNAL_URL="http://localhost:3000"
+NUXT_PORT=4000

.git-blame-ignore-revs

@@ -0,0 +1,7 @@
+# .git-blame-ignore-revs
+# Add commit hashes (full 40-char) of bulk formatting/refactoring commits below.
+# Configure: git config blame.ignoreRevsFile .git-blame-ignore-revs
+# GitHub auto-detects this file; no additional config needed.
+#
+# Template for bulk SonarCloud mechanical fixes commit:
+# <full-sha-here>  Bulk SonarCloud mechanical fixes (S1481, S1488, S1854, S1125, S7741)

.github/CODEOWNERS

@@ -0,0 +1,17 @@
+# Security-sensitive routes — require review
+# Auth: webauthn, passkey, MFA, OIDC, TOTP
+/server/server/api/v1/auth/ @BillyOutlast
+/server/server/internal/auth/ @BillyOutlast
+
+# Metadata providers — external HTTP integration, complex fallthrough
+/server/server/internal/metadata/ @BillyOutlast
+
+# Nitro server core (server/ dir)
+/server/server/ @BillyOutlast
+
+# Build, deps, CI
+/server/.env.example @BillyOutlast
+/.github/workflows/ @BillyOutlast
+/AGENTS.md @BillyOutlast
+/CLAUDE.md @BillyOutlast
+/CONTRIBUTING.md @BillyOutlast

.github/ISSUE_TEMPLATE/bug.yml

@@ -0,0 +1,104 @@
+name: Bug Report
+description: Report a bug or issue with Drop
+title: "[Bug]: "
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to report a bug! Please fill out the information below to help us investigate.
+
+  - type: textarea
+    id: description
+    attributes:
+      label: Bug Description
+      description: A clear and concise description of what the bug is.
+      placeholder: Tell us what happened...
+    validations:
+      required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to Reproduce
+      description: Steps to reproduce the behavior.
+      placeholder: |
+        1. Go to '...'
+        2. Click on '...'
+        3. Scroll down to '...'
+        4. See error
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected Behavior
+      description: A clear and concise description of what you expected to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual Behavior
+      description: A clear and concise description of what actually happened.
+    validations:
+      required: true
+
+  - type: textarea
+    id: screenshots
+    attributes:
+      label: Screenshots
+      description: If applicable, add screenshots to help explain your problem.
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Affected Component
+      description: Which part of Drop is affected?
+      options:
+        - Server (API/Backend)
+        - Desktop Client
+        - CLI
+        - Documentation
+        - CI/CD
+        - Other
+    validations:
+      required: true
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: What version of Drop are you running?
+      placeholder: e.g., 1.0.0
+
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: |
+        Any relevant environment details:
+        - OS: [e.g., Ubuntu 22.04, Windows 11, macOS 14]
+        - Browser (if applicable): [e.g., Chrome 120, Firefox 121]
+        - Node.js version (if applicable):
+        - pnpm version (if applicable):
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant Logs
+      description: |
+        Please copy and paste any relevant log output.
+        **Before submitting, redact any tokens, passwords, private keys, and personal information.**
+      render: shell
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow our Code of Conduct
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true

.github/ISSUE_TEMPLATE/feature.yml

@@ -0,0 +1,74 @@
+name: Feature Request
+description: Suggest a new feature or enhancement for Drop
+title: "[Feature]: "
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for suggesting a feature! Please fill out the information below to help us understand your request.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem Statement
+      description: A clear and concise description of what problem this feature would solve.
+      placeholder: I'm always frustrated when...
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed Solution
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives Considered
+      description: A clear and concise description of any alternative solutions or features you've considered.
+
+  - type: dropdown
+    id: component
+    attributes:
+      label: Affected Component
+      description: Which part of Drop would this affect?
+      options:
+        - Server (API/Backend)
+        - Desktop Client
+        - CLI
+        - Documentation
+        - CI/CD
+        - Other
+    validations:
+      required: true
+
+  - type: dropdown
+    id: priority
+    attributes:
+      label: Priority
+      description: How important is this feature to you?
+      options:
+        - Nice to have
+        - Important
+        - Critical for my use case
+    validations:
+      required: true
+
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Context
+      description: Add any other context, screenshots, or examples about the feature request here.
+
+  - type: checkboxes
+    id: terms
+    attributes:
+      label: Code of Conduct
+      description: By submitting this issue, you agree to follow our Code of Conduct
+      options:
+        - label: I agree to follow this project's Code of Conduct
+          required: true

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,36 @@
+## Description
+
+<!-- Briefly describe the changes in this PR -->
+
+## Related Issues
+
+<!-- Link any related issues: Fixes #123, Relates to #456 -->
+
+## Type of Change
+
+- [ ] Bug fix (non-breaking change which fixes an issue)
+- [ ] New feature (non-breaking change which adds functionality)
+- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
+- [ ] Documentation update
+- [ ] Refactoring (no functional changes)
+- [ ] CI/CD improvement
+- [ ] Dependency update
+
+## Checklist
+
+- [ ] My code follows the project's coding style
+- [ ] I have performed a self-review of my own code
+- [ ] I have commented my code, particularly in hard-to-understand areas
+- [ ] I have made corresponding changes to the documentation
+- [ ] My changes generate no new warnings
+- [ ] I have added tests that prove my fix is effective or that my feature works
+- [ ] New and existing unit tests pass locally with my changes
+- [ ] Any dependent changes have been merged and published
+
+## Testing
+
+<!-- Describe the tests you ran and how to reproduce them -->
+
+## Screenshots (if applicable)
+
+<!-- Add screenshots to help explain your changes -->