Verified each finding against the real codebase first, since the review's
diff was polluted by a stale leftover agent-worktree copy under
.claude/worktrees/ (now removed) that made several already-fixed or
never-broken issues look current (CORS, missing typecheck script, PWA
icons, font CSS, Helmet/Swagger CSP - all confirmed fine live, not
touched).
Real fixes:
- main.ts: fail-fast on missing DATABASE_URL/JWT_ACCESS_SECRET at boot,
call enableShutdownHooks() so PrismaService.onModuleDestroy() actually
runs on SIGTERM during k8s rolling deploys, PORT fallback 3000 -> 3001
to match every other place that documents the port.
- health.controller.ts: log the real underlying DB error instead of
discarding it, add a 5s timeout to the readiness query so a hung DB
fails the probe fast instead of blocking indefinitely.
- Frontend Dockerfile: declare ARG/ENV NEXT_PUBLIC_API_URL before the
build step, since Next.js inlines NEXT_PUBLIC_* vars at build time and
a runtime-only ConfigMap value never reaches the compiled bundle.
- Backend ingress.yaml: drop the no-op rewrite-target regex for a plain
prefix path (identical behavior, less confusing).
Nick Szaunig