Bound what the API accepts, and close the holes the audit found

**SQLite is the database, and now says so.** `metric_minute` and every run
table are written with `sqlalchemy.dialects.sqlite.insert(...)
.on_conflict_do_update` and with `max(a, b)`, neither of which another
dialect has — so pointing `DATABASE_URL` at Postgres migrated cleanly,
served, logged in, and then lost every observability flush into the
collector's hold buffer and failed every run. It refuses at startup
instead. (The Postgres in the compose stack is Umami's; the engine's own
database has been a file beside the flows since 2026-08-21.)

**Every integer query parameter is bounded.** The caps were written as
`min(limit, 500)`, which a negative walks straight through — `?limit=-1`
compiles to `LIMIT -1` and SQLite returns the whole table. Ten signatures,
now `Query(ge=…, le=…)`. `hours=0` still means an hour, which
`_window_hours` was already deliberate about.

**Exports are capped at 10 000 runs** and say so with `X-Truncated`. The
filters bounded a sensible request and nothing bounded an unfiltered one,
which read every row into memory before a byte was streamed. `_series`
resolves cached curves in two queries rather than a `Run` lookup and a
`RunMetric` query per restored node — a comparison of twenty runs was
calling that twenty times over.

**`PUT /artifacts` has a size limit** (`MAX_ARTIFACT_BYTES`, 2 GiB, 0 to
disable), checked against `Content-Length` and again against the stream for
a chunked body, and its writes moved off the event loop.

**`/observability/timeseries` takes `since`/`until`**, the same window
`/runs` and `/events` take, capped at 2000 points — `hours=720&bucket_s=60`
was 43 200 of them in one array. It is also what a dragged chart needs to
re-fetch at its own resolution rather than magnifying buckets it has.

**Composite indexes** for the three list screens: `run(flow, created_at)`
and `(status, created_at)`, `flow_run(flow, started_at)`,
`engine_event(type, ts)`. Every index was single-column, so SQLite picked
one and sorted the rest by hand. Verified against a copy of a live database
(250k `flow_run` rows): the planner takes all four.

**Redis clients have socket timeouts.** A Redis that stops answering
without closing the connection hung the caller until the kernel gave up —
including `/utils/health/`, whose job is to notice.

**The panels file is written under one lock.** `save_panels` and
`unpair_panel` are both read-modify-write, and a save that read before an
unpair wrote put the old nonce back — silently un-revoking a screen that
had just been unpaired. The nonce carry-forward was written to make that
impossible; the gap between its read and its write is where it happened.

**Startup releases what it acquired.** Everything past `event_bus.bind`
registers how to close itself and the `finally` walks that list backwards;
a failure part-way through used to reach none of the shutdown steps and
leave the worker pool's subprocesses and every background task behind —
under `--reload`, once per bad edit. `modules.reconcile` moved into the
background: `uv` gets five minutes twice over, the healthcheck allows
eighty seconds, and the autoheal restarted the container before it could
finish installing.

`delete_run` takes SQLite's write lock up front (`core.db.writing`) rather
than upgrading a deferred transaction and losing to whichever flush
committed in between. `modules.sync` is serialised — two applies mutated
one venv at once. The proxied-call and stream dicts are bounded, and a
reused id cancels its predecessor instead of dropping the reference.

Security, found in passing and small enough to fix here:

- **`/secrets/` required only a signed-in user.** The names alone say what
  this installation talks to, and `PUT /{name}` takes any name, so any
  account could overwrite the credential a flow authenticates with.
  Superuser now — which `/search` already assumed and said so.
- **`POST /login/access-token` had no rate limit.** Argon2 is deliberately
  expensive and the route is unauthenticated and runs in the shared
  threadpool. Ten *failed* attempts per address per five minutes; a
  successful sign-in spends nothing.
- **a password reset link worked repeatedly for 48 hours.** The token now
  carries a digest of the password hash it was minted against, so it stops
  verifying once it has set one. No table of spent tokens needed.
- **enrolment accepted `http://`**, sending the claim code and then this
  installation's credential in clear. https, or a local address.
- the rate limiter read `request.client.host`, which behind Traefik is the
  proxy — so every per-address limit was one global bucket and one caller
  could lock out everyone. It reads the forwarded address, and its
  bucket table is capped rather than growing one key per address forever.
- SMTP has a timeout and sends after the response, so an unreachable mail
  host cannot pin a threadpool worker, and a reply's timing no longer says
  whether the address exists.

Test suite: engine-written rows are cleared between modules. A `FlowRun`
left `running` by one module turned up in another's query. Per-test
rollback is not available here — the module-scoped `client` runs the real
lifespan and its collector and run service write through sessions of their
own — so this bounds it where the writes come from. Three consecutive
green runs, orders randomised.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6hPWS6YEbT1P8LxhhFb2T

backend/fluksio/api/routes/panels.py

@@ -35,7 +35,15 @@ from fluksio.cloud import config as cloud_config
 from fluksio.core import security
 from fluksio.core.config import settings
 from fluksio.flow.events import event_bus
-from fluksio.flow.panels import PanelDef, PanelsConfig, find, read_config, write_config
+from fluksio.flow.panels import (
+    PanelDef,
+    PanelsConfig,
+    edit_lock,
+    find,
+    read_config,
+    write_config,
+)
+from fluksio.flow.state import CONNECT_TIMEOUT_S, SOCKET_TIMEOUT_S
 from fluksio.models import Message
 
 #: Gated per route rather than on the router: the two pairing endpoints are the
@@ -104,6 +112,10 @@ class _PendingStore:
                 host=settings.REDIS_HOST,
                 port=settings.REDIS_PORT,
                 decode_responses=True,
+                # A silent Redis must fail this request, not hold it open.
+                socket_timeout=SOCKET_TIMEOUT_S,
+                socket_connect_timeout=CONNECT_TIMEOUT_S,
+                health_check_interval=30,
             )
             if settings.REDIS_HOST
             else None
@@ -288,7 +300,6 @@ async def save_panels(body: PanelsConfig) -> Any:
     how a device is unpaired along with its assignment. Re-pairing one screen
     and keeping the assignment is ``/{panel_id}/unpair`` below.
     """
-    stored = {p.id: p.nonce for p in (await run_in_threadpool(read_config)).panels}
     seen = set()
     for panel in body.panels:
         if panel.id in seen:
@@ -296,12 +307,20 @@ async def save_panels(body: PanelsConfig) -> Any:
                 status_code=422, detail=f"Two panels named {panel.id!r}"
             )
         seen.add(panel.id)
-        # The nonce belongs to this installation, not to whoever is writing the
-        # panels back: a client holding an older copy must not be able to undo
-        # a revocation by saving an arrangement.
-        panel.nonce = stored.get(panel.id, 0)
 
-    await run_in_threadpool(write_config, body)
+    def _save() -> None:
+        # Read and write under one lock. The nonce belongs to this
+        # installation, not to whoever is writing the panels back: a client
+        # holding an older copy must not be able to undo a revocation by
+        # saving an arrangement — and reading it in a separate step from
+        # writing it is exactly how an unpair in between was undone.
+        with edit_lock:
+            stored = {p.id: p.nonce for p in read_config().panels}
+            for panel in body.panels:
+                panel.nonce = stored.get(panel.id, 0)
+            write_config(body)
+
+    await run_in_threadpool(_save)
     # Which dashboards hang on which panel just changed. An empty name says
     # that much and no more: every screen listening rescopes and refetches
     # what it shows, rather than waiting for whenever it next reads.
@@ -436,12 +455,19 @@ async def unpair_panel(panel_id: str) -> Any:
     A credential the portal minted for a remote screen carries no nonce, so
     this does not reach it; that one is revoked at the hub.
     """
-    config = await run_in_threadpool(read_config)
-    panel = next((p for p in config.panels if p.id == panel_id), None)
-    if panel is None:
+
+    def _unpair() -> bool:
+        with edit_lock:
+            config = read_config()
+            panel = next((p for p in config.panels if p.id == panel_id), None)
+            if panel is None:
+                return False
+            panel.nonce += 1
+            write_config(config)
+            return True
+
+    if not await run_in_threadpool(_unpair):
         raise HTTPException(status_code=404, detail=f"No panel named {panel_id!r}")
-    panel.nonce += 1
-    await run_in_threadpool(write_config, config)
     # The screen is still holding a socket. One event and it refetches, which
     # is where it meets the 401 that sends it back to the pairing code.
     event_bus.publish({"type": "dashboard_changed", "dashboard": "", "ts": time.time()})