security: fix critical webhook direct upgrade path, seed auth, CORS Vary header

- Webhook polar/route: block direct ?userId=&tier= upgrades in production (NODE_ENV guard)
- Seed route: require ADMIN_SECRET via x-admin-secret header
- Feedback route: require FEEDBACK_ADMIN_TOKEN env var in production
- CORS middleware: add Vary: Origin header for caching correctness
- MOCK_PAYMENTS: add NODE_ENV production guard
- Wallet top-up: add production guard for mock mode when POLAR_ACCESS_TOKEN unset

.gitea/workflows/ci.yml

@@ -1,12 +1,54 @@
-name: CI
+name: Deploy Staging
 
 on:
   push:
     branches: [main]
 
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: falah-mobile
+  STAGING_HOST: 192.168.0.17
+
 jobs:
-  test:
+  build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - run: echo "CI on Falah OS Gitea!"
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Generate Prisma client
+        run: npx prisma generate
+
+      - name: Build Next.js app
+        run: npm run build
+        env:
+          DATABASE_URL: "file:./prisma/dev.db"
+
+      - name: Build Docker image
+        run: |
+          docker build -t ${{ env.IMAGE_NAME }}:staging .
+          docker save ${{ env.IMAGE_NAME }}:staging | gzip > /tmp/${{ env.IMAGE_NAME }}.tar.gz
+
+      - name: Deploy to staging
+        run: |
+          scp /tmp/${{ env.IMAGE_NAME }}.tar.gz root@${{ env.STAGING_HOST }}:/opt/${{ env.IMAGE_NAME }}/
+          ssh root@${{ env.STAGING_HOST }} << 'EOF'
+            cd /opt/${{ env.IMAGE_NAME }}
+            docker load < ${{ env.IMAGE_NAME }}.tar.gz
+            docker compose -f docker-compose.staging.yml down
+            docker compose -f docker-compose.staging.yml up -d
+            for i in $(seq 1 30); do
+              sleep 2
+              curl -sf http://localhost:4014/mobile/api/health && echo "✅ Staging is healthy" && break
+            done
+          EOF
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}