fix(release): make deployment backup and rollback immutable

backend/tests/test_docker_runtime_config.py

@@ -172,6 +172,25 @@ def test_walloon_runtime_settings_are_editable_in_compose_and_unraid() -> None:
         assert "WALOUS_MAX_PIXELS" in content
 
 
+def test_in_memory_vector_limit_is_propagated_and_validated_in_every_runtime() -> None:
+    expected = "GEOINTEL_MAX_IN_MEMORY_VECTOR_MB"
+    for path in (
+        ROOT / ".env.example",
+        ROOT / "docker-compose.yml",
+        ROOT / "docker-compose.unraid.yml",
+        ROOT / "deploy" / "unraid" / "geointel.env.example",
+        ROOT / "deploy" / "unraid" / "geointel-unraid-template.xml",
+    ):
+        assert expected in path.read_text(encoding="utf-8"), path
+
+    run_script = (ROOT / "deploy" / "unraid" / "run-dockerman-container.sh").read_text(
+        encoding="utf-8"
+    )
+    assert 'GEOINTEL_MAX_IN_MEMORY_VECTOR_MB="${GEOINTEL_MAX_IN_MEMORY_VECTOR_MB:-64}"' in run_script
+    assert "GEOINTEL_MAX_IN_MEMORY_VECTOR_MB must be between 1 and 256." in run_script
+    assert '-e GEOINTEL_MAX_IN_MEMORY_VECTOR_MB="$GEOINTEL_MAX_IN_MEMORY_VECTOR_MB"' in run_script
+
+
 def test_frontend_uses_same_origin_api_proxy_by_default() -> None:
     api_client = (ROOT / "frontend" / "src" / "services" / "api" / "client.ts").read_text(encoding="utf-8")
     nginx_config = (ROOT / "frontend" / "nginx.conf").read_text(encoding="utf-8")
@@ -208,6 +227,45 @@ def test_nginx_runtime_allows_long_ai_and_qa_requests() -> None:
         assert "proxy_send_timeout 600s;" in config
 
 
+def test_nginx_preserves_outer_https_scheme_for_secure_session_cookies() -> None:
+    configs = (
+        (ROOT / "frontend" / "nginx.conf").read_text(encoding="utf-8"),
+        (ROOT / "deploy" / "unraid" / "nginx-all-in-one.conf").read_text(encoding="utf-8"),
+    )
+    for config in configs:
+        assert "geo $geointel_trusted_forwarder" in config
+        assert "default 0;" in config
+        assert "172.16.0.0/12 1;" in config
+        assert 'map "$geointel_trusted_forwarder:$http_x_forwarded_proto"' in config
+        assert '"1:https" https;' in config
+        assert "proxy_set_header X-Forwarded-Proto $geointel_forwarded_proto;" in config
+        assert "proxy_set_header X-Forwarded-Proto $scheme;" not in config
+
+
+def test_nginx_runtime_sets_security_headers_on_all_cached_locations() -> None:
+    configs = (
+        (ROOT / "frontend" / "nginx.conf").read_text(encoding="utf-8"),
+        (ROOT / "deploy" / "unraid" / "nginx-all-in-one.conf").read_text(
+            encoding="utf-8"
+        ),
+    )
+    required = (
+        'Content-Security-Policy "frame-ancestors \'none\'" always;',
+        'X-Frame-Options "DENY" always;',
+        'X-Content-Type-Options "nosniff" always;',
+        'Referrer-Policy "strict-origin-when-cross-origin" always;',
+        'Permissions-Policy "camera=(), microphone=(), geolocation=()" always;',
+    )
+
+    for config in configs:
+        cached_locations = config.count("add_header Cache-Control")
+        assert cached_locations >= 2
+        for header in required:
+            # Nginx 1.27 locations with Cache-Control do not inherit server-level
+            # add_header directives, so every cached location repeats the policy.
+            assert config.count(f"add_header {header}") == cached_locations + 1
+
+
 def test_compose_does_not_publish_postgis_on_default_host_port() -> None:
     compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")