[ayushcmd]

Summary

Implements the Phase 2A P0 security remediations for CloudMonitor Issue #12.

Security changes

• Block unauthenticated Prometheus lifecycle endpoints through Nginx with HTTP 403 responses.
• Remove Prometheus --web.enable-lifecycle from production Compose.
• Enforce fail-closed production validation for JWT_SECRET_KEY and DATABASE_URL.
• Restrict PostgreSQL URL schemes to the supported SQLAlchemy drivers (postgresql, postgresql+psycopg2).
• Add Nginx login endpoint rate limiting (5 requests/minute with burst 5 and nodelay).

Verification

• Backend and agent tests: 74 passed, 0 failed.
• Targeted security and metrics tests: 38 passed, 0 failed.
• Frontend production build: passed.
• Nginx syntax validation: passed using temporary upstream hostname mappings; live upstream connectivity was not tested.
• Local Docker Compose validation: passed.
• Production Docker Compose validation: passed.
• Production dependency audit (npm audit --omit=dev): 0 vulnerabilities.

Known remaining risks

• SEC-CRIT-01: Public production HTTP traffic remains unencrypted; TLS is deferred to Phase 2B.
• Prometheus read telemetry remains publicly accessible without authentication; only lifecycle actions are blocked.
• SEC-HIGH-01: Agent Docker socket privileges require further hardening.
• SEC-HIGH-04: EC2 IAM instance profile and SSM migration remain outstanding.
• Frontend development dependency audit reports two Vite/esbuild vulnerabilities; upgrades are intentionally deferred and tracked.

Deployment safety

• No production infrastructure changes were performed.
• This PR does not authorize production deployment.
• Do not merge until reviewed, and review the CD workflow implications before merging to main.