H1: model_validator in Settings raises ValueError when jwt_secret_key is
"changeme" and the process is running inside a container — fast-fail
prevents insecure deployments; local dev outside Docker is unaffected.
H7: generate_order_number now acquires pg_advisory_xact_lock before SELECT MAX,
matching the same pattern used in generate_invoice_number (billing/service.py).
Concurrent order creation can no longer race to produce duplicate numbers.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
H4: add internal_api_base_url setting to config.py (default http://localhost:8888,
env-overridable via INTERNAL_API_BASE_URL); replace all 5 hardcoded base_url
strings in chat_service.py.
H6: add post-read size check in both Excel and STEP upload handlers;
raises HTTP 413 when content exceeds settings.max_upload_size_mb.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
HartmutandClaude Sonnet 4.6