Harden the container: non-root, pinned images and dependencies, the key in a file (B-91, SEC-51, SEC-52, SEC-53; closes B-71, B-72)

- app runs as uid 1000; a one-shot data-permissions service chowns ./data to it
  and closes it to others (works on an older root-owned install with no host sudo);
  files are created 0600 (umask 077)
- python:3.12-slim and caddy:2-alpine pinned by digest; dependencies installed from
  requirements.lock with --require-hashes
- the Fernet key is XPRV_ENCRYPTION_KEY_FILE (./secrets/xprv_encryption.key, a compose
  secret), out of every environment variable and of a ./data backup
- setup.md no longer presents a second way to run the server (B-72)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

scripts/decrypt_master_key.py

@@ -8,7 +8,7 @@ locally, only when you actually need it (e.g. disaster-recovery backup).
 Usage:
     python scripts/decrypt_master_key.py
 
-Requires XPRV_ENCRYPTION_KEY to already be set (.env), same as the running
+Requires XPRV_ENCRYPTION_KEY_FILE (.env) to point at the key file, same as the running
 server. Looks for the encrypted key at MASTER_KEY_PATH (.env) — if that path
 doesn't exist, falls back to ./data/keys/master.xprv.enc, the location
 docker-compose.yml bind-mounts it to, since .env's default (./master.xprv.enc)
@@ -34,7 +34,7 @@ def _resolve_key_path() -> str:
 
 if __name__ == "__main__":
     if not settings.xprv_encryption_key:
-        raise SystemExit("XPRV_ENCRYPTION_KEY is not set")
+        raise SystemExit("XPRV_ENCRYPTION_KEY_FILE is not set, or its file is missing or empty")
 
     key_path = _resolve_key_path()
 

scripts/encrypt_master_key.py

@@ -1,6 +1,6 @@
 """One-time ops bootstrap: encrypt an externally-generated master xprv and
 write it to disk, using the exact same scheme generate_master_key.py uses
-(Fernet, XPRV_ENCRYPTION_KEY). Use this instead of generate_master_key.py
+(Fernet, the key in XPRV_ENCRYPTION_KEY_FILE). Use this instead of generate_master_key.py
 when you already have an xprv from elsewhere (e.g. generated offline/air-
 gapped) and want to bring your own instead of letting the server create one.
 
@@ -12,7 +12,7 @@ Usage:
     python scripts/encrypt_master_key.py
     python scripts/encrypt_master_key.py --overwrite   # replace an existing key
 
-Requires XPRV_ENCRYPTION_KEY to already be set (.env). Writes to
+Requires XPRV_ENCRYPTION_KEY_FILE (.env) to point at the key file. Writes to
 MASTER_KEY_PATH (.env) — falls back to ./data/keys/master.xprv.enc (the
 docker-compose.yml bind-mount location) if that directory exists and .env's
 default path doesn't, same fallback as decrypt_master_key.py.
@@ -48,7 +48,7 @@ if __name__ == "__main__":
     args = parser.parse_args()
 
     if not settings.xprv_encryption_key:
-        raise SystemExit("XPRV_ENCRYPTION_KEY is not set")
+        raise SystemExit("XPRV_ENCRYPTION_KEY_FILE is not set, or its file is missing or empty")
 
     key_path = _resolve_key_path()
     if os.path.exists(key_path) and not args.overwrite:

scripts/generate_master_key.py

@@ -2,7 +2,7 @@
 
 Usage:
     python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
-    # put that value in XPRV_ENCRYPTION_KEY (.env), then:
+    # write it to the file XPRV_ENCRYPTION_KEY_FILE (.env) points at, then:
     python scripts/generate_master_key.py
 """
 
@@ -12,7 +12,7 @@ from app.wallet.verify import load_sample
 
 if __name__ == "__main__":
     if not settings.xprv_encryption_key:
-        raise SystemExit("XPRV_ENCRYPTION_KEY is not set")
+        raise SystemExit("XPRV_ENCRYPTION_KEY_FILE is not set, or its file is missing or empty")
     sample = load_sample()
     if sample.users or sample.rounds or sample.seeds:
         # SEC-50: a new key cannot reproduce the addresses the database already holds.