Harden LLMHarbor for production

[PLASMA-FR]

Summary

• hardens routing, fallback, provider isolation, streaming, tool calls, quotas, OAuth, custom endpoints, shutdown, and OpenAI compatibility
• migrates local client keys to hash-only storage and makes encryption/backup restore fail closed and crash safer
• strengthens dashboard/control-plane authorization, CSRF/authority checks, SSRF defenses, error redaction, validation, and database integrity
• matures the Bash and PowerShell CLI plus Linux, macOS, and Windows installation/update flows
• redesigns the dashboard around operational workflows with clearer health, routing, analytics, key policy, Playground, and backup experiences
• refreshes documentation and pins least-privilege CI across supported Node 22 and 24 lines

Verification

• npm ci and full npm run check on clean Node 22 and Node 24 installs
• 40 server test files / 393 tests
• client lint, TypeScript build, Vite production build, and 3 SSE parser tests
• isolated end-to-end OpenAI-compatible provider journey: auth, models, auto/explicit routes, SSE, usage, tools, policies, analytics, and probes
• Chromium desktop and 768px responsive walkthrough of all primary routes
• axe WCAG A/AA: zero violations across all primary routes in the verified build
• dependency and production dependency audits: zero vulnerabilities
• ShellCheck, Bash syntax, PowerShell parser, actionlint, workflow YAML, docs links, diff check, and secret scan

Operational notes

• Node 22.12+ or Node 24 is required.
• client API key secrets are revealed only at creation/regeneration; existing plaintext rows migrate to hashes.
• database restores are staged and activated on restart, with key compatibility validated before activation.
• externally supervised installations must be stopped before update/build; the CLI detects the standard systemd unit and provides safe guidance.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c8c44241-f5e2-47de-a93f-2edba5ae65b0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[PLASMA-FR]

Committed and pushed the complete production-hardening work directly to main as requested. Closing this draft PR; no PR merge is required.