Security: Classify S5332 HTTP hotspots and document internal Docker networking boundary

[Copilot]

SonarCloud flags many http:// URLs under python:S5332 / typescript:S5332. Most are internal Docker service addresses or test-only localhost URLs that are safe given Curvit's single-host architecture with TLS terminated at Traefik.

Documentation

New file: docs/security/internal-networking.md

• Diagrams the TLS boundary (Traefik terminates public TLS; internal services communicate via plain HTTP on the private Docker network)
• Classifies all hotspot categories: internal Docker URLs, test-only URLs, E2E loopback URLs, XML/JSON Schema namespace identifiers
• Confirms internal service ports are not published externally
• Notes future obligation to revisit if topology moves to multi-host

NOSONAR annotations

Inline // NOSONAR: S5332 / # NOSONAR: S5332 comments added on the exact flagged lines with brief justifications. Categories covered:

Internal Docker service URLs — server-side only, never browser-facing:

// apps/app-frontend/src/lib/api/internal-auth.ts
const getInternalApiBaseUrl = () =>
  process.env.INTERNAL_API_URL || process.env.CORE_API_URL || 'http://core-api:5000'; // NOSONAR: S5332 - Internal Docker URL; server-side only.

# workers/analysis-worker/app/config.py
core_api_base_url: str = "http://core-api:5000"  # NOSONAR: S5332

E2E test loopback URLs — guarded by PLAYWRIGHT_E2E=1 / isPlaywrightE2EEnabled(), never reached in production:

return `http://127.0.0.1:41017/settings?checkout=success&tier=${tier}`; // NOSONAR: S5332 - E2E test-only URL; guarded by isPlaywrightE2EEnabled().

Test-only mock settings — no real network connections made:

mock_settings.sanitiser_service_url = "http://content-sanitiser:8000"  # NOSONAR: S5332 - test-only mock value

XML/JSON Schema namespace identifiers — static identifiers for XML parsers, not network requests:

namespace = "http://schemas.openxmlformats.org/wordprocessingml/2006/main"  # NOSONAR: S5332 - XML namespace identifier, not a network request.

httpx test transport — standard httpx test convention; ASGITransport never makes real connections:

async with httpx.AsyncClient(transport=transport, base_url="http://test") as test_client:  # NOSONAR: S5332 - standard httpx test transport placeholder

Files annotated span: apps/app-frontend/src/, apps/marketing-site/src/, workers/analysis-worker/app/, services/*/app/, shared/, and their respective test suites.