feat: implement Phase 1 hardening

- Verify JWT signatures via JWKS in auth.py
- Fix broken frontend auth button references
- Add Pydantic Settings for env validation (RETENTION_DAYS, CORS_ORIGINS)
- Create MongoDB indexes + TTL on startup
- Add /health endpoint and CORS middleware
- Escape regex input in event queries
- Fix dedupe() return calculation in maintenance.py
- Replace basic logging with structured structlog JSON logs
- Update README and add ROADMAP.md

.env.example

@@ -14,3 +14,12 @@ AUTH_ALLOWED_GROUPS=
 MONGO_ROOT_USERNAME=root
 MONGO_ROOT_PASSWORD=example
 MONGO_PORT=27017
+
+# MongoDB connection string (takes precedence over root credentials in Docker Compose)
+MONGO_URI=mongodb://root:example@localhost:27017
+
+# Optional: number of days to retain events in MongoDB (0 = disabled)
+RETENTION_DAYS=0
+
+# Optional: comma-separated CORS origins (e.g., http://localhost:3000,https://app.example.com)
+CORS_ORIGINS=*