perf: prepared statements, CSP, digest pin, вырезание design-preview, нагрузочные бюджеты, jsdom-тесты web, composite CI, SBOM/Trivy

deploy/docker-compose.traefik.yml

@@ -29,6 +29,7 @@ services:
       - --providers.docker=true
       - --providers.docker.exposedbydefault=false
       - --providers.docker.network=auth-portal
+      - --ping=true
       - --entrypoints.web.address=:80
       - --entrypoints.websecure.address=:443
       - --entrypoints.web.http.redirections.entrypoint.to=websecure
@@ -43,6 +44,12 @@ services:
       - traefik_letsencrypt:/letsencrypt
     networks:
       - auth-portal
+    healthcheck:
+      test: ["CMD", "traefik", "healthcheck", "--ping"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 15s
     logging:
       driver: json-file
       options:
@@ -69,7 +76,8 @@ services:
     security_opt:
       - no-new-privileges:true
     depends_on:
-      - traefik
+      traefik:
+        condition: service_healthy
     # No host ports — only Traefik publishes 80/443.
     env_file:
       - .env