Harden security controls from REPORT findings

doc/api-contract.md

@@ -12,7 +12,8 @@ Primary implementation modules:
 
 ## Authentication And Authorization
 
-- Protected endpoints require `Authorization: Bearer <token>`.
+- Protected endpoints require `Authorization: Bearer <token>` in production.
+- Development deployments can allow tokenless user-role access for `documents/*` and `search/*` when `ALLOW_DEVELOPMENT_ANONYMOUS_USER_ACCESS=true`.
 - `ADMIN_API_TOKEN` is required for all privileged access and acts as fail-closed root credential.
 - `USER_API_TOKEN` is optional and, when configured, grants access to document endpoints only.
 - Authorization matrix:
@@ -29,7 +30,8 @@ Primary implementation modules:
 
 ## Documents
 
-- Access: admin or user token required
+- Access: admin or user token required (production)
+- Access: admin or user token, or development tokenless user fallback when enabled
 
 ### Collection and metadata helpers
 
@@ -56,7 +58,8 @@ Primary implementation modules:
 - `GET /documents/{document_id}/download`
   - Response: original file bytes
 - `GET /documents/{document_id}/preview`
-  - Response: inline preview stream where browser-supported
+  - Response: inline preview stream only for safe MIME types
+  - Behavior: script-capable MIME types are forced to attachment responses with `X-Content-Type-Options: nosniff`
 - `GET /documents/{document_id}/thumbnail`
   - Response: generated thumbnail image when available
 - `GET /documents/{document_id}/content-md`
@@ -126,10 +129,12 @@ Primary implementation modules:
 - `GET /settings`
   - Response model: `AppSettingsResponse`
   - persisted providers with invalid base URLs are ignored during read sanitization; response falls back to remaining valid providers or secure defaults
+  - provider API keys are exposed only as `api_key_set` and `api_key_masked`
 - `PATCH /settings`
   - Body model: `AppSettingsUpdateRequest`
   - Response model: `AppSettingsResponse`
   - rejects invalid provider base URLs with `400` when scheme, allowlist, or network safety checks fail
+  - provider API keys are persisted encrypted at rest (`api_key_encrypted`) and plaintext keys are not written to storage
 - `POST /settings/reset`
   - Response model: `AppSettingsResponse`
 - `PATCH /settings/handwriting`