Harden security, rewrite docs for public release

[blackaxgit]

Summary

• Harden application security — fix path traversal, streaming bug, add FFmpeg timeouts, input validation, error sanitization with correlation IDs
• Harden infrastructure — Dockerfile non-root user + HEALTHCHECK, Helm NetworkPolicy, readOnlyRootFilesystem, automount disabled
• Rewrite README with comprehensive API docs, error responses, configuration reference, accurate Helm values table, and n8n integration
• Sanitize n8n workflow — replace real instance/webhook UUIDs with placeholder zeros
• Add supplementary docs — CONTRIBUTING.md, .env.example, improved .gitignore

Security Fixes

Fix	Severity	File
Path traversal via output_prefix	Critical	app/main.py
AUTO streaming mode never activating	Critical	app/main.py
No FFmpeg subprocess timeout (DoS)	Critical	app/main.py
DoS via unbounded chunk_size_mb	High	app/main.py
FFmpeg stderr / exception leak to client	Medium	app/main.py
output_format not validated	Medium	app/main.py
Dockerfile runs as root	Medium	Dockerfile
ServiceAccount token auto-mounted	High	values.yaml
No NetworkPolicy	High	Helm templates
n8n instance IDs exposed	Medium	workflow JSON

Test plan

• docker build -t audio-splitter:test . succeeds
• docker run --rm audio-splitter:test id shows uid=1000(appuser)
• curl POST /split with valid audio returns 200 with base64 chunks
• curl POST /split -F output_prefix=../../etc/passwd sanitizes prefix
• curl POST /split -F chunk_size_mb=0.01 returns 400 (below minimum)
• curl POST /split -F output_format=exe -F same_as_input=false returns 400
• Error responses contain correlation IDs, no internal paths or stderr
• helm template renders NetworkPolicy, automount:false, readOnlyRootFilesystem:true
• helm template --set networkPolicy.enabled=false excludes NetworkPolicy
• No real UUIDs in n8n-test-flow/audio-splitter-workflow.json

🤖 Generated with Claude Code