M3: cors_origins setting in config.py (env CORS_ORIGINS); main.py reads from settings.
M4: add build_order_line_step_render_dir() to render_paths.py; tasks.py drops placeholder.mp4 trick.
M5: unknown workflow graph nodes now fail the run (status="failed" + logger.error) instead of silently skipping.
M6: invoice line description is now "{product} — {output_type}" instead of bare UUID; eager-loads relations.
M7: order_number_prefix setting in config.py (env ORDER_NUMBER_PREFIX, default "SA").
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
H1: model_validator in Settings raises ValueError when jwt_secret_key is
"changeme" and the process is running inside a container — fast-fail
prevents insecure deployments; local dev outside Docker is unaffected.
H7: generate_order_number now acquires pg_advisory_xact_lock before SELECT MAX,
matching the same pattern used in generate_invoice_number (billing/service.py).
Concurrent order creation can no longer race to produce duplicate numbers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
H4: add internal_api_base_url setting to config.py (default http://localhost:8888,
env-overridable via INTERNAL_API_BASE_URL); replace all 5 hardcoded base_url
strings in chat_service.py.
H6: add post-read size check in both Excel and STEP upload handlers;
raises HTTP 413 when content exceeds settings.max_upload_size_mb.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
HartmutandClaude Sonnet 4.6