feat(security): harden canvas server with auth, rate-limiting, and validation

- Add security.ts: helmet, CORS allowlist, timing-safe API key auth, prototype
  pollution guard, Mermaid input limits, rate limiting (general/destructive/burst)
- WS auth challenge-response with 5 s timeout and close code 4001
- Fix sync crash: array check before logger access (500 → 400)
- Fix sync/v2: validate element type before write (invalid → 400)
- Upgrade zod 3.22.4 → 3.25.5 (fixes ERR_PACKAGE_PATH_NOT_EXPORTED on startup)
- Extract ElementSharedFieldsSchema; move VALID_ELEMENT_TYPES to module level
- Docker: resource limits, .dockerignore hardening
- Add .project-hooks/pre-commit; expand test coverage (369 tests)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -22,8 +22,14 @@ services:
     environment:
       - NODE_ENV=production
       - PORT=3000
+      # HOST=0.0.0.0 is intentional in Docker — the container's port is
+      # exposed only via the published port mapping above. For local dev
+      # without Docker, the default is localhost (set in src/server.ts).
       - HOST=0.0.0.0
       - DEBUG=false
+      # Optional: set to enable API key auth on all /api/* routes.
+      # Must match EXCALIDRAW_API_KEY in the mcp service below so inter-service calls succeed.
+      - EXCALIDRAW_API_KEY=${EXCALIDRAW_API_KEY:-}
     restart: unless-stopped
     healthcheck:
       test: ["CMD", "node", "-e", "require('http').get('http://localhost:3000/health', (r) => process.exit(r.statusCode === 200 ? 0 : 1))"]
@@ -31,6 +37,11 @@ services:
       timeout: 10s
       retries: 3
       start_period: 40s
+    deploy:
+      resources:
+        limits:
+          cpus: '1.0'
+          memory: 512M
     networks:
       - mcp-network
 
@@ -49,9 +60,16 @@ services:
       - EXPRESS_SERVER_URL=http://canvas:3000
       - ENABLE_CANVAS_SYNC=true
       - DEBUG=false
+      # Must match canvas EXCALIDRAW_API_KEY so inter-service sync calls are authenticated.
+      - EXCALIDRAW_API_KEY=${EXCALIDRAW_API_KEY:-}
     depends_on:
       canvas:
         condition: service_healthy
+    deploy:
+      resources:
+        limits:
+          cpus: '0.5'
+          memory: 256M
     networks:
       - mcp-network
     profiles: