Stabilize runtime auth and E2E coverage

infra/docker-compose.yml

@@ -1,12 +1,3 @@
-# Vignette — 이식 가능한 단일 호스트 배포 구성
-# 어디서든:  cp .env.example .env && (값 채우고) && docker compose up -d
-#
-# 설계 원칙:
-#  - web/api/db/voice/rag 는 전부 컨테이너 → 호스트 무관하게 한 방에 뜬다.
-#  - "엔진"(로컬 claude -p)만 컨테이너 밖. api 는 ENGINE_URL 로 가리킨다.
-#    → 옮길 때 ENGINE_URL 한 줄만 바꾸면 됨(로컬 게이트웨이 ↔ API 폴백).
-#  - 시크릿/엔드포인트는 전부 .env. 이미지에 굽지 않는다(이식성).
-
 name: vignette
 
 services:
@@ -14,14 +5,16 @@ services:
     image: pgvector/pgvector:pg16
     restart: unless-stopped
     environment:
-      POSTGRES_USER: ${POSTGRES_USER:-vignette}
+      POSTGRES_USER: ${POSTGRES_USER:-vignette_owner}
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?set in .env}
       POSTGRES_DB: ${POSTGRES_DB:-vignette}
+      APP_DB_USER: ${APP_DB_USER:-vignette_app}
+      APP_DB_PASSWORD: ${APP_DB_PASSWORD:?set in .env}
     volumes:
       - pgdata:/var/lib/postgresql/data
-      - ./db/init:/docker-entrypoint-initdb.d:ro   # 스키마/확장 초기화 SQL
+      - ./db/init:/docker-entrypoint-initdb.d:ro
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-vignette}"]
+      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-vignette_owner}"]
       interval: 10s
       timeout: 5s
       retries: 5
@@ -35,20 +28,32 @@ services:
     depends_on:
       db: { condition: service_healthy }
     environment:
-      DATABASE_URL: postgresql://${POSTGRES_USER:-vignette}:${POSTGRES_PASSWORD}@db:5432/${POSTGRES_DB:-vignette}
-      # === 엔진(이식성 핵심) ===
-      # 로컬 운영: host 의 claude -p 게이트웨이를 가리킴(아래 extra_hosts 사용)
-      # 클라우드 이전: 이 값을 Messages API 어댑터 URL 로만 바꾸면 됨.
+      ENVIRONMENT: ${ENVIRONMENT:?set ENVIRONMENT in .env}
+      DATABASE_URL: postgresql://${APP_DB_USER:-vignette_app}:${APP_DB_PASSWORD}@db:5432/${POSTGRES_DB:-vignette}
       ENGINE_URL: ${ENGINE_URL:-http://host.docker.internal:9099}
-      ENGINE_MODE: ${ENGINE_MODE:-claude_p}          # claude_p | messages_api
-      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}      # 폴백/클라우드용
-      OPENAI_API_KEY: ${OPENAI_API_KEY:?set in .env} # 음성
+      ENGINE_MODE: ${ENGINE_MODE:-claude_cli}
+      ANTHROPIC_API_KEY: ${ANTHROPIC_API_KEY:-}
+      OPENAI_API_KEY: ${OPENAI_API_KEY:?set in .env}
+      OPENAI_BASE_URL: ${OPENAI_BASE_URL:-https://api.openai.com/v1}
       RAG_EMBED_URL: http://rag:8080
       SESSION_SECRET: ${SESSION_SECRET:?set in .env}
+      OAUTH_GOOGLE_CLIENT_ID: ${OAUTH_GOOGLE_CLIENT_ID:?set in .env}
+      OAUTH_GOOGLE_CLIENT_SECRET: ${OAUTH_GOOGLE_CLIENT_SECRET:?set in .env}
+      OAUTH_REDIRECT_URI: ${OAUTH_REDIRECT_URI:-https://api-vignette.chanpaca.net/auth/callback}
+      AUTH_ALLOWED_EMAIL_DOMAINS: '${AUTH_ALLOWED_EMAIL_DOMAINS:-["hs.ac.kr","twentyoz.kr"]}'
+      AUTH_TEACHER_EMAILS: '${AUTH_TEACHER_EMAILS:-[]}'
+      AUTH_ADMIN_EMAILS: '${AUTH_ADMIN_EMAILS:-[]}'
+      AUTH_DEV_LOGIN_ENABLED: ${AUTH_DEV_LOGIN_ENABLED:-false}
+      DEFAULT_AFFILIATION: ${DEFAULT_AFFILIATION:-}
+      AUTO_SEED_PERSONAS: ${AUTO_SEED_PERSONAS:-false}
+      ALLOW_SEED_PERSONA_FALLBACK: ${ALLOW_SEED_PERSONA_FALLBACK:-false}
+      EVALUATOR_GOLDEN_FEWSHOT_ENABLED: ${EVALUATOR_GOLDEN_FEWSHOT_ENABLED:-false}
+      FRONTEND_BASE_URL: ${FRONTEND_BASE_URL:-https://vignette.chanpaca.net}
+      CORS_ORIGINS: '${CORS_ORIGINS:-["https://vignette.chanpaca.net","https://vignette-b1q.pages.dev"]}'
     extra_hosts:
-      - "host.docker.internal:host-gateway"   # 컨테이너→호스트 엔진 게이트웨이 접근(Linux 포함)
+      - "host.docker.internal:host-gateway"
     healthcheck:
-      test: ["CMD", "python", "-c", "import urllib.request,sys; urllib.request.urlopen('http://localhost:8000/health'); "]
+      test: ["CMD", "python", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
       interval: 15s
       timeout: 5s
       retries: 5
@@ -64,7 +69,6 @@ services:
     depends_on: [api]
     networks: [vignette]
 
-  # RAG 사이드카: BGE-M3 임베딩 + BGE-reranker-v2-m3 (CPU 가능, GPU 있으면 가속)
   rag:
     build:
       context: ../apps/api
@@ -74,10 +78,9 @@ services:
       EMBED_MODEL: BAAI/bge-m3
       RERANK_MODEL: BAAI/bge-reranker-v2-m3
     volumes:
-      - ragmodels:/models   # 모델 캐시(재다운로드 방지 = 이식 시 볼륨만 옮기면 빠름)
+      - ragmodels:/models
     networks: [vignette]
 
-  # 리버스프록시 + TLS. 외부노출(chanpaca.net)도 여기서. 끄려면 profiles 로 제외.
   proxy:
     image: caddy:2-alpine
     restart: unless-stopped