feat: stabilize API startup and lifecycle management

- Refactor server initialization to separate concerns and improve error handling.
- Implement centralized environment validation using Zod.
- Introduce database, Redis, and queue lifecycle management.
- Add health check endpoints for liveness and readiness.
- Enhance error handling middleware for better response structure.
- Implement rate limiting for API endpoints.
- Add request ID middleware for traceability.
- Create Sequelize CLI configuration and baseline migration for schema management.
- Establish CI workflow with Gitea for testing and syntax checks.
- Document foundational changes and migration strategy in PHASE_0_FOUNDATION_STABILIZATION.md.
- Add Docker Compose configuration for local development and testing.
- Implement unit and integration tests for critical functionality.

app/routes/auth.routes.js

@@ -13,6 +13,9 @@ const express = require('express');
 const router = express.Router();
 const authController = require('../controllers/auth.controller');
 const {authenticate} = require('../middleware/auth.middleware');
+const { sensitiveLimiter } = require('../middleware/rateLimit.middleware');
+
+router.use(sensitiveLimiter);
 
 // GET /api/auth/me
 router.get("/me", authenticate, (req, res) => {

app/routes/docs.routes.js

@@ -6,6 +6,7 @@ const express = require("express");
 const fs = require("fs");
 const path = require("path");
 const docsSession = require("../middleware/docsSession.middleware");
+const { sensitiveLimiter } = require("../middleware/rateLimit.middleware");
 
 const router = express.Router();
 
@@ -47,7 +48,7 @@ router.get("/view/:file", docsSession, (req, res) => {
 });
 
 // Docs login (simple)
-router.post("/login", (req, res) => {
+router.post("/login", sensitiveLimiter, (req, res) => {
   const { username, password } = req.body;
 
   if (

app/routes/health.routes.js

@@ -0,0 +1,24 @@
+const express = require("express");
+const { checkDatabase } = require("../config/database.lifecycle");
+const { checkRedis } = require("../config/redis.lifecycle");
+
+const router = express.Router();
+
+const live = (_req, res) => res.json({
+  status: "ok",
+  service: "zumri-api",
+  timestamp: new Date().toISOString(),
+  uptime: process.uptime(),
+});
+
+router.get("/live", live);
+router.get("/ready", async (_req, res) => {
+  const [database, redis] = await Promise.all([checkDatabase(), checkRedis()]);
+  const ready = database && redis;
+  res.status(ready ? 200 : 503).json({
+    status: ready ? "ready" : "not_ready",
+    checks: { database: database ? "ok" : "error", redis: redis ? "ok" : "error" },
+  });
+});
+
+module.exports = { healthRouter: router, live };

app/routes/profile.routes.js

@@ -19,10 +19,11 @@ const {
   checkPermission,
 } = require("../middleware/permission.middleware");
 const PERMISSIONS = require("../constants/permissions");
+const { sensitiveLimiter } = require("../middleware/rateLimit.middleware");
 
-router.post("/req-reset-password", profileController.requestPasswordReset);
+router.post("/req-reset-password", sensitiveLimiter, profileController.requestPasswordReset);
 
-router.post("/reset-password", profileController.resetPassword);
+router.post("/reset-password", sensitiveLimiter, profileController.resetPassword);
 
 router.post(
   "/change-password",