fix: harden web runtime and follow-up auth/db security fixes (#21)

## Summary
- harden the web runtime with JSON body limits, stricter generation input validation, rate limiting, and trusted Origin/Referer checks for cookie-authenticated mutations
- redact password-reset tokens from debug email transport logs and fail closed for unsupported email providers
- scope generation idempotency keys per user with a Prisma migration and regression coverage

## Testing
- docker build -f infra/docker/web.Dockerfile -t nroxy-web-check .
- docker run --rm --entrypoint sh nroxy-web-check -lc "pnpm --filter @nproxy/providers test && pnpm --filter @nproxy/db test && pnpm --filter @nproxy/web test"

Closes #14
Closes #7
Closes #8

Co-authored-by: sirily <sirily@git.shararam.party>
Reviewed-on: #21

packages/db/prisma/migrations/20260311160000_scope_generation_idempotency_per_user/migration.sql

@@ -0,0 +1,4 @@
+DROP INDEX "GenerationRequest_idempotencyKey_key";
+
+CREATE UNIQUE INDEX "GenerationRequest_userId_idempotencyKey_key"
+ON "GenerationRequest"("userId", "idempotencyKey");

packages/db/prisma/schema.prisma

@@ -187,7 +187,7 @@ model GenerationRequest {
   resolutionPreset  String
   batchSize         Int
   imageStrength     Decimal?                @db.Decimal(4, 3)
-  idempotencyKey    String?                 @unique
+  idempotencyKey    String?
   terminalErrorCode String?
   terminalErrorText String?
   requestedAt       DateTime                @default(now())
@@ -200,6 +200,7 @@ model GenerationRequest {
   assets            GeneratedAsset[]
   usageLedgerEntry  UsageLedgerEntry?
 
+  @@unique([userId, idempotencyKey])
   @@index([userId, status, requestedAt])
 }