Harden API with rate limits, DeviceId isolation, and tighter CORS.

Limit auth/read/write JSON traffic per IP while leaving audio streams unrestricted; close JWT+deviceId IDOR and add path/input guards.

Co-authored-by: Cursor <cursoragent@cursor.com>

k8s/manifest.yaml

@@ -3,6 +3,8 @@ kind: Namespace
 metadata:
   name: tafsirquran
 ---
+# SECURITY: Rotate MSSQL_SA_PASSWORD and Jwt__Key out-of-band; prefer sealed-secrets /
+# external secret store. Do not commit newly rotated production credentials to git.
 apiVersion: v1
 kind: Secret
 metadata:
@@ -25,6 +27,7 @@ data:
   Jwt__Issuer: "TafsirQuran"
   Jwt__Audience: "TafsirQuran"
   Jwt__ExpireMinutes: "43200"
+  Cors__Origins__0: "https://quran.afrino.co"
 ---
 apiVersion: v1
 kind: ConfigMap