Close the adversarial review round: auth hardening, data fidelity against the platform context, backend grants and docker coherence

src/index.ts

@@ -1,7 +1,7 @@
 import { serve } from "bun";
 import index from "./index.html";
 
-const port = process.env.PORT ? parseInt(process.env.PORT) : 3000;
+const port = process.env.PORT ? parseInt(process.env.PORT) : 5000;
 
 // Strict base64 check (not a mere `Buffer.from` attempt, which silently drops invalid
 // characters instead of failing): reject anything that is not a well-formed base64 body