chore(cleanup): Wave 1 — remove 20 orphaned files in mission-control

.gitignore

@@ -13,6 +13,7 @@ dist/
 .DS_Store
 *.pem
 .env*.local
+.env.production
 
 # npm (project uses pnpm)
 package-lock.json

docker-compose.yml

@@ -1,3 +1,13 @@
+# Base compose file with security defaults baked in.
+#
+# Production hardening overlay (docker-compose.hardened.yml) adds:
+#   - logging: json-file driver with max-size 10m / max-file 3 (prevents disk fill)
+#   - environment: MC_ALLOWED_HOSTS, MC_COOKIE_SECURE=1, MC_COOKIE_SAMESITE=strict,
+#     MC_ENABLE_HSTS=1 (forces secure cookies and HSTS headers)
+#   - networks: mc-internal with internal:true (no external/internet access)
+#
+# To use: docker compose -f docker-compose.yml -f docker-compose.hardened.yml up -d
+
 services:
   mission-control:
     build: .
@@ -49,6 +59,7 @@ services:
       - NET_BIND_SERVICE
     security_opt:
       - no-new-privileges:true
+    # Hardened overlay adds: logging driver json-file (max-size 10m, max-file 3)
     deploy:
       resources:
         limits:
@@ -57,6 +68,15 @@ services:
           pids: 256
     networks:
       - mc-net
+    # Health endpoint: /api/status?action=health (no auth required).
+    # The Dockerfile also defines a HEALTHCHECK; this compose-level check takes
+    # precedence and uses the same healthcheck.js script baked into the image.
+    healthcheck:
+      test: ["CMD", "node", "/app/healthcheck.js"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 30s
     restart: unless-stopped
 
   # Standalone mode — no gateway required. Start with:
@@ -77,3 +97,5 @@ volumes:
 networks:
   mc-net:
     driver: bridge
+    # Hardened overlay replaces this with mc-internal (internal: true)
+    # to block all outbound internet access from the container.

package.json

@@ -33,7 +33,6 @@
     "@xterm/addon-fit": "^0.11.0",
     "@xterm/addon-web-links": "^0.12.0",
     "@xterm/xterm": "^6.0.0",
-    "@xyflow/react": "^12.10.0",
     "autoprefixer": "^10.4.20",
     "better-sqlite3": "^12.6.2",
     "class-variance-authority": "^0.7.1",
@@ -49,7 +48,6 @@
     "react": "^19.0.1",
     "react-dom": "^19.0.1",
     "react-markdown": "^10.1.0",
-    "reactflow": "^11.11.4",
     "reagraph": "^4.30.8",
     "recharts": "^3.7.0",
     "remark-gfm": "^4.0.1",