feat: production deployment - full update with providers, admin, glossaries, pricing, tests

Major changes across backend, frontend, infrastructure:
- Provider system with model selection (Google, DeepL, OpenAI, Ollama, Google Cloud)
- Admin panel: user management, pricing, settings
- Glossary system with CSV import/export
- Subscription and tier quota management
- Security hardening (rate limiting, API key auth, path traversal fixes)
- Docker compose for dev, prod, and IONOS deployment
- Alembic migrations for new tables
- Frontend: dashboard, pricing page, landing page, i18n (en/fr)
- Test suite and verification scripts

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -1,5 +1,9 @@
 # Document Translation API - Production Docker Compose
-# Usage: docker-compose -f docker-compose.yml -f docker-compose.prod.yml up -d
+# Usage: docker compose up -d
+#        (or: docker-compose up -d)
+#
+# All services run in production mode (no code mounts, built images).
+# Secrets: set in .env at project root (see .env.example "Production / VPS" section).
 
 version: '3.8'
 
@@ -13,7 +17,8 @@ services:
     restart: unless-stopped
     environment:
       - POSTGRES_USER=${POSTGRES_USER:-translate}
-      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-translate_secret_123}
+      # Production: set POSTGRES_PASSWORD in .env (required, no default — NFR10)
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
       - POSTGRES_DB=${POSTGRES_DB:-translate_db}
       - PGDATA=/var/lib/postgresql/data/pgdata
     volumes:
@@ -40,11 +45,14 @@ services:
     build:
       context: .
       dockerfile: docker/backend/Dockerfile
+      target: production
     container_name: translate-backend
     restart: unless-stopped
+    env_file:
+      - .env
     environment:
-      # Database
-      - DATABASE_URL=postgresql+asyncpg://${POSTGRES_USER:-translate}:${POSTGRES_PASSWORD:-translate_secret_123}@postgres:5432/${POSTGRES_DB:-translate_db}
+      # Database (POSTGRES_PASSWORD must be set in .env — no default)
+      - DATABASE_URL=postgresql+asyncpg://${POSTGRES_USER:-translate}:${POSTGRES_PASSWORD}@postgres:5432/${POSTGRES_DB:-translate_db}
       # Redis
       - REDIS_URL=redis://redis:6379/0
       # Translation Services
@@ -62,8 +70,8 @@ services:
       # Admin Auth (CHANGE IN PRODUCTION!)
       - ADMIN_USERNAME=${ADMIN_USERNAME}
       - ADMIN_PASSWORD=${ADMIN_PASSWORD}
-      # Security
-      - JWT_SECRET=${JWT_SECRET}
+      # Security (.env.example documents JWT_SECRET_KEY)
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY}
       - CORS_ORIGINS=${CORS_ORIGINS:-https://yourdomain.com}
       # Stripe Payments
       - STRIPE_SECRET_KEY=${STRIPE_SECRET_KEY:-}
@@ -102,10 +110,13 @@ services:
     build:
       context: .
       dockerfile: docker/frontend/Dockerfile
-      args:
-        - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://backend:8000}
+      target: production
+    args:
+      - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://backend:8000}
     container_name: translate-frontend
     restart: unless-stopped
+    env_file:
+      - .env
     environment:
       - NEXT_PUBLIC_API_URL=${NEXT_PUBLIC_API_URL:-http://backend:8000}
     networks:
@@ -140,6 +151,7 @@ services:
     depends_on:
       - frontend
       - backend
+    # Config syntax only; to verify proxy reachability run: curl -f https://your-domain/health (see DEPLOYMENT_GUIDE)
     healthcheck:
       test: ["CMD", "nginx", "-t"]
       interval: 30s
@@ -184,6 +196,7 @@ services:
       interval: 10s
       timeout: 5s
       retries: 5
+      start_period: 5s
 
   # ===========================================
   # Prometheus (Optional - Monitoring)