security: address all findings from vulnerability assessment

Implements the fixes catalogued under Task Master tasks 1-19, derived
from the security audit at .claude/plans/adaptive-sleeping-diffie.md.

Critical
- C-1 SSRF userinfo bypass: PDF proxy now rejects URLs containing
  userinfo or non-default ports, and asserts netloc == hostname.
- C-2 No authentication: optional NADLAN_API_KEY gate guards
  /api/search/*, /api/appraisals/pdf and /mcp until Traefik mTLS
  is wired up. Default behavior unchanged when env unset.

High
- H-1 Error info leak: HTTPException details replaced with generic
  string; full exceptions still logged via logger.exception.
- H-2 Security headers middleware: HSTS, X-Frame-Options, nosniff,
  Referrer-Policy, Permissions-Policy, CSP, server-banner stripped.
- H-3 Swagger gated: /api/docs and /api/openapi.json hidden when
  ENVIRONMENT=production.
- H-4 PDF proxy DoS: streams in 8KB chunks, rejects upstream above
  50MB Content-Length, also rejects mid-stream overrun. Magic-byte
  check moved before StreamingResponse so we can 502 cleanly.
- H-5 Per-IP rate limit: token-bucket per (path, IP) on /mcp,
  /api/search/*, /api/appraisals/pdf. Reads X-Forwarded-For for
  client IP behind Traefik.

Medium
- M-1 CORS: ALLOWED_ORIGINS env, allow_headers narrowed, no creds.
- M-2 Deal model: extra="ignore" + explicit fields for gushNum,
  parcelNum, subParcelNum, streetNameHeb, houseNum, deal_source,
  deal_type, deal_type_description, distance_meters. Frontend now
  reads snake_case.
- M-3 Input validators: regex on block, plot, appraiser names,
  dates, address, free-text — Hebrew + Latin + safe punctuation.
- M-4 COOLIFY_UUID moved out of deploy.yaml into Gitea Actions
  secret.
- M-5 Base images pinned to sha256 digests.
- M-6 Runtime deps tightened to ~= compatible-release.
- M-7 1MB request-body size limit middleware.

Low / privacy
- L-1 Heebo self-hosted via @fontsource. Removed Google Fonts links
  and CSP entries. Added meta referrer + meta robots noindex.
- L-2 Cache-Control: immutable for /assets, no-cache for HTML.
- L-3 Logger no longer prints user-supplied addresses; emits length
  only.
- L-4 Dockerfile healthcheck uses literal port 8000.
- L-5 PDF proxy stream cleanup uses contextlib.suppress.

Tests: 331 passed, 17 skipped. Frontend typecheck passes.
Findings file: .claude/plans/adaptive-sleeping-diffie.md
Tasks: .taskmaster/tasks/tasks.json

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

nadlan_mcp/govmap/models.py

@@ -138,6 +138,25 @@ class Deal(BaseModel):
     priority: Optional[int] = Field(
         None, description="Priority for sorting (0=same building, 1=street, 2=neighborhood)"
     )
+    # Set after parsing by find_recent_deals_for_address based on which
+    # polygon the deal was sourced from. Not from upstream — explicit so
+    # extra='ignore' (M-2) doesn't strip it on serialization.
+    deal_source: Optional[str] = Field(
+        None,
+        description="Provenance bucket: same_building / street / neighborhood",
+    )
+    deal_type: Optional[int] = Field(
+        None,
+        description="Deal type filter applied (1=first hand, 2=second hand)",
+    )
+    deal_type_description: Optional[str] = Field(
+        None,
+        description="Human-readable deal-type label",
+    )
+    distance_meters: Optional[float] = Field(
+        None,
+        description="Distance from search-center coordinates (meters)",
+    )
 
     # Geometry and internal fields (often not useful for analysis)
     shape: Optional[str] = Field(None, description="WKT geometry")
@@ -146,9 +165,36 @@ class Deal(BaseModel):
     )
     sourceorder: Optional[int] = Field(None, description="Source ordering")
 
+    # Cadastral identifiers (used by the UI columns גוש/חלקה/תת-חלקה).
+    # Modeled explicitly so we no longer rely on `extra="allow"` to leak
+    # arbitrary upstream keys into the response — see security audit M-2.
+    gush_num: Optional[int] = Field(None, alias="gushNum", description="Block (גוש) number")
+    parcel_num: Optional[int] = Field(None, alias="parcelNum", description="Parcel (חלקה) number")
+    sub_parcel_num: Optional[int] = Field(
+        None, alias="subParcelNum", description="Sub-parcel (תת-חלקה) number"
+    )
+
+    # Govmap uses two different street/house keys depending on the source
+    # endpoint. `street_name` (alias `streetName`) is set by some APIs;
+    # `street_name_heb` (alias `streetNameHeb`) is what the UI table reads.
+    # `settlement_name_heb` is already declared above.
+    street_name_heb: Optional[str] = Field(
+        None, alias="streetNameHeb", description="Street name in Hebrew"
+    )
+    house_num: Optional[Any] = Field(
+        None,
+        alias="houseNum",
+        description="House number (Govmap-side; may differ from house_number)",
+    )
+
     model_config = ConfigDict(
         populate_by_name=True,  # Allow both alias and field name
-        extra="allow",  # Allow extra fields from API that we don't model
+        # `ignore` (not `forbid`): Govmap occasionally introduces new
+        # fields and we don't want validation to break. But we DO want
+        # to stop silently propagating unknown content into our response
+        # (which `allow` did). All upstream fields we actually use are
+        # now modeled explicitly above.
+        extra="ignore",
     )
 
     @computed_field