feat: harden control panel authentication

docker-compose.control-panel.yml

@@ -23,6 +23,9 @@ services:
       CP_BIND: 0.0.0.0
       CP_PORT: "3010"
       CASAN_APP_ROOT: /app
+      # Browser-login CLIs are workstation-only. Production uses managed API
+      # credentials/workload identity and must not call a developer host bridge.
+      CASAN_PROVIDER_ACCOUNT_AUTH_ENABLED: "0"
     volumes:
       - ${CASAN_CP_STATE_DIR:?Set CASAN_CP_STATE_DIR}:/app/.specify
       - ${CASAN_CP_OUTPUT_DIR:?Set CASAN_CP_OUTPUT_DIR}:/app/docs/output:ro
@@ -45,7 +48,7 @@ services:
       - casan-control
 
   oauth2-proxy:
-    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+    image: ${CASAN_CP_OAUTH2_PROXY_IMAGE:?Set a digest-pinned CASAN_CP_OAUTH2_PROXY_IMAGE}
     restart: unless-stopped
     env_file:
       - path: ${CASAN_CP_OAUTH_ENV:?Set CASAN_CP_OAUTH_ENV}
@@ -57,6 +60,11 @@ services:
       - --pass-access-token=false
       - --pass-authorization-header=false
       - --skip-provider-button=true
+      - --cookie-secure=true
+      - --cookie-httponly=true
+      - --cookie-samesite=lax
+      - --cookie-expire=8h
+      - --cookie-refresh=1h
     expose:
       - "4180"
     networks: