feat: add production capability foundations

src/.env

@@ -12,9 +12,20 @@ APP_ERROR_DETAIL_EXPOSURE_ENABLED=false
 APP_LOG_BODY_CAPTURE_ENABLED=false
 APP_MULTI_INSTANCE_ENABLED=false
 APP_MIGRATION_ON_STARTUP=true
-APP_RATE_LIMIT_ENABLED=true
+APP_RATE_LIMIT_ENABLED=false
 APP_RATE_LIMIT_CLIENT_IP_MODE=remote-addr-only
+APP_RATE_LIMIT_PROVIDER=disabled
+APP_RATE_LIMIT_REDIS_KEY_HMAC_SECRET=
 APP_IDEMPOTENCY_TTL=24h
+APP_IDEMPOTENCY_PROVIDER=jdbc
+APP_IDEMPOTENCY_REDIS_KEY_HMAC_SECRET=
+APP_IDEMPOTENCY_REDIS_NAMESPACE_ENVIRONMENT=local
+APP_IDEMPOTENCY_PROCESSING_LEASE=30s
+APP_IDEMPOTENCY_FAILURE_RETENTION=24h
+APP_LEASE_PROVIDER=disabled
+APP_LEASE_REDIS_KEY_HMAC_SECRET=
+APP_LEASE_REDIS_NAMESPACE_ENVIRONMENT=local
+APP_LEASE_REDIS_DRIFT_BUDGET=10ms
 
 # ----- Async executor -----
 APP_ASYNC_EXECUTOR_CORE_SIZE=10
@@ -22,6 +33,13 @@ APP_ASYNC_EXECUTOR_MAX_SIZE=50
 APP_ASYNC_EXECUTOR_QUEUE_CAPACITY=200
 
 # ----- Optional integration adapters (default: all disabled) -----
+APP_CACHE_CANONICAL_DEFAULT_PROVIDER=disabled
+# Sentinel primary revalidation cadence for canonically active Sentinel roles.
+APP_REDIS_SENTINEL_DISCOVERY_REFRESH_PERIOD=30s
+# Canonical role semantic readiness: refresh no more often than this interval.
+APP_REDIS_SEMANTIC_PROBE_MINIMUM_INTERVAL=5s
+# Fail closed when the last completed semantic observation is older than this bound.
+APP_REDIS_SEMANTIC_PROBE_MAXIMUM_STALENESS=15s
 APP_CACHE_REDIS_ENABLED=false
 APP_CACHE_REDIS_CLIENT_MODE=managed
 APP_CACHE_REDIS_HOST=localhost
@@ -34,6 +52,13 @@ APP_CACHE_REDIS_MAXIMUM_IN_FLIGHT_BYTES=16777216
 APP_CACHE_REDIS_NAMESPACE_ENVIRONMENT=local
 APP_CACHE_REDIS_SEMANTIC_REGION=default
 APP_CACHE_REDIS_MAXIMUM_VALUE_BYTES=1048576
+APP_CACHE_REDIS_L1_ENABLED=false
+APP_CACHE_REDIS_L1_MAXIMUM_ENTRIES=10000
+APP_CACHE_REDIS_L1_MAXIMUM_WEIGHT_BYTES=67108864
+APP_CACHE_REDIS_L1_MAXIMUM_ENTRY_WEIGHT_BYTES=1048576
+APP_CACHE_REDIS_L1_TTL=30s
+APP_CACHE_REDIS_L1_GENERATION_RECHECK_INTERVAL=5s
+APP_CACHE_REDIS_L1_INVALIDATION_QUEUE_CAPACITY=1024
 APP_CACHE_DEFAULT_TTL=300s
 APP_CACHE_NEGATIVE_TTL=60s
 APP_MESSAGING_BROKER=
@@ -41,23 +66,6 @@ APP_MESSAGING_KAFKA_BROKERS=
 APP_NOTIFICATION_SLACK_PROVIDER=
 APP_NOTIFICATION_EMAIL_PROVIDER=
 
-# ----- Outbound HTTP client -----
-APP_OUTBOUND_HTTP_CONNECT_TIMEOUT=2s
-APP_OUTBOUND_HTTP_READ_TIMEOUT=5s
-APP_OUTBOUND_HTTP_GLOBAL_CALL_TIMEOUT=10s
-APP_OUTBOUND_HTTP_MAXIMUM_IN_FLIGHT_CALLS=128
-APP_OUTBOUND_HTTP_RETRY_ENABLED=false
-APP_OUTBOUND_HTTP_RETRY_MAX_ATTEMPTS=3
-APP_OUTBOUND_HTTP_RETRY_INITIAL_BACKOFF=100ms
-APP_OUTBOUND_HTTP_RETRY_BACKOFF_MULTIPLIER=2.0
-APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_ENABLED=false
-APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_FAILURE_RATE_THRESHOLD=50
-APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_SLIDING_WINDOW_SIZE=100
-APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_MINIMUM_NUMBER_OF_CALLS=100
-APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_WAIT_DURATION_IN_OPEN_STATE=60s
-APP_OUTBOUND_HTTP_CIRCUIT_BREAKER_PERMITTED_CALLS_IN_HALF_OPEN=10
-APP_OUTBOUND_HTTP_RESPONSE_SIZE_LIMIT=10MB
-
 # ----- Logging: root & app levels -----
 APP_LOG_LEVEL_ROOT=INFO
 APP_LOG_LEVEL_APP=DEBUG
@@ -130,9 +138,26 @@ APP_SERVER_ERROR_INCLUDE_MESSAGE=never
 PRESENTATION_API_BASE_PATH=/api
 
 # ----- Auth (OIDC resource server) -----
+APP_SECURITY_AUTH_MODE=jwt
 APP_SECURITY_JWT_ISSUER=http://localhost:8081/realms/ca-skeleton
 APP_SECURITY_JWT_AUDIENCE=ca-skeleton-api
 SECURITY_PUBLIC_PATHS=/api/healthcheck
+APP_SESSION_COOKIE_NAME=CA_SESSION
+APP_SESSION_COOKIE_SECURE=true
+APP_SESSION_COOKIE_HTTP_ONLY=true
+APP_SESSION_COOKIE_SAME_SITE=Lax
+APP_SESSION_COOKIE_PATH=/
+APP_SESSION_CSRF_COOKIE_NAME=XSRF-TOKEN
+APP_SESSION_CSRF_HEADER_NAME=X-XSRF-TOKEN
+APP_SESSION_REDIS_KEY_HMAC_SECRET=
+APP_SESSION_REDIS_NAMESPACE_ENVIRONMENT=local
+APP_SESSION_IDLE_TIMEOUT=30m
+APP_SESSION_ABSOLUTE_LIFETIME=8h
+APP_SESSION_TOUCH_INTERVAL=1m
+APP_SESSION_TOMBSTONE_TTL=5m
+APP_SESSION_MAXIMUM_ENVELOPE_BYTES=32768
+APP_SESSION_MAXIMUM_ATTRIBUTES=64
+APP_SESSION_MAXIMUM_SCALAR_BYTES=8192
 
 # ----- CORS -----
 APP_SECURITY_CORS_ENABLED=true