M41: harden trust boundaries and delivery

backend/app/core/config.py

@@ -23,6 +23,8 @@ class Settings(BaseSettings):
     ragcore_api_token: str = ""
     ragcore_space_id: str = ""
     ragcore_http_timeout_seconds: float = 5.0
+    # Search fallback is only labelled grounded above this explicit retrieval threshold.
+    ragcore_min_search_score: float = 0.05
     n8n_webhook_url: str = "http://n8n:5678/webhook/mobilityops-return"
     n8n_webhook_trigger_token: str = "replace-me-n8n-webhook-trigger-token"
     n8n_callback_token: str = "replace-me-n8n-callback-token"
@@ -67,6 +69,8 @@ class Settings(BaseSettings):
     # Failed password logins per client IP before a temporary 429 (0 disables).
     login_max_failures: int = 10
     login_failure_window_seconds: int = 900
+    knowledge_max_requests: int = 30
+    knowledge_rate_limit_window_seconds: int = 60
     metrics_bearer_token: str = ""
     privacy_minimum_booking_retention_days: int = 30
     privacy_audit_retention_days: int = 2555
@@ -86,13 +90,11 @@ INSECURE_DEFAULT_SECRETS: tuple[tuple[str, str], ...] = (
 def insecure_default_secrets(settings: "Settings") -> list[str]:
     """Return the names of secret settings that still carry their placeholder value.
 
-    Only secrets that actually guard something in the given deployment are reported:
-    ``mcp_hub_service_token`` is irrelevant while MCP Hub registration is disabled.
+    MCP routes are always mounted, independently of the Hub reachability-status flag, so
+    their inbound token must always be non-placeholder in production.
     """
     insecure: list[str] = []
     for name, placeholder in INSECURE_DEFAULT_SECRETS:
-        if name == "mcp_hub_service_token" and not settings.mcp_hub_registration_enabled:
-            continue
         value = getattr(settings, name)
         if not value or value == placeholder or value.startswith("replace-me"):
             insecure.append(name)
@@ -112,4 +114,8 @@ def get_settings() -> Settings:
                 + ", ".join(insecure)
                 + ". Set real values in the environment (see .env.example)."
             )
+        if not settings.mobilityops_public_url.lower().startswith("https://"):
+            raise RuntimeError("Production MOBILITYOPS_PUBLIC_URL must use HTTPS.")
+        if not settings.session_cookie_secure:
+            raise RuntimeError("Production SESSION_COOKIE_SECURE must be true.")
     return settings