Tracking: framework gaps for porting gis-data-portal — sweep 2 #542

Second sweep of framework gaps for porting gis-data-portal onto SimpleModule. It follows #460: all 12 issues from the first sweep (#447–#459) are closed, and their fixes were spot-checked against the portal's needs (routing, worker tuning, heartbeats, retry-after-commit, S3 streaming/range, multipart, PATs, OpenAPI export, rehash, outbox). Verified against main @ ec46dc4b. Each issue stands alone.

P0: blocks running the portal in production

• auth: Bearer scheme matching is case-sensitive, but /auth/token returns token_type "bearer" #533 auth: Bearer scheme is case-sensitive, but /auth/token returns "bearer" (bug; breaks the Flutter client)
• background_tasks: cached sync engine is not reset after Celery prefork, so children can share inherited DB connections #532 background_tasks: reset the cached sync engine after prefork (bug)
• db: expose pool-wait, connect, statement and idle-in-transaction timeouts for web and worker engines #531 db: pool-wait, connect, statement and idle-in-transaction timeouts (web + worker)
• hosting: configurable CORS — credentialed API origin allowlist plus public range-resource policy #527 hosting: configurable CORS (credentialed API allowlist + public range-resource policy)
• users: login lockout is per-process and keyed by username+IP, so it does not hold across workers or source IPs #530 users: persistent account lockout across workers and IPs (bug)
• permissions: resource-scoped access (owner / shared-with-user / public) and permission-aware list filtering #526 permissions: resource-scoped access (owner / shared / public) + list filtering

P1: needed for feature parity

• openapi: declare cookie/Bearer/PAT security schemes on protected operations #534 openapi: security schemes on protected operations (generated clients)
• inertia: server-side rendering (or server-rendered <head>) for public pages #535 inertia: SSR or a server-rendered <head> for public pages (SEO / OG)
• hosting: honour X-Forwarded-Host behind a trusted proxy, with a host allowlist #528 hosting: allowlisted X-Forwarded-Host
• hosting/rate-limits: per-route policies for authenticated users, keyed by user id #529 hosting/rate-limits: authenticated per-route policies keyed by user
• background_tasks: progress reporting from tasks and status reads scoped to the task's owner #536 background_tasks: task progress + owner-scoped status reads
• runtime: distributed TTL leases (owner-checked locks and concurrency slots) #539 runtime: distributed TTL leases and concurrency slots

P2: operations and migration convenience

• observability: retain and query task/app log records (correlated by task id) #537 observability: retained, queryable task/app logs
• observability: optional Sentry (error reporting) integration for web and workers #538 observability: optional Sentry integration
• cli/docker: scaffold separately built worker images (native libs / GPU) alongside the web image #540 cli/docker: separate native/GPU worker images
• hosting/ui: mount a legacy client-routed SPA under a prefix (deep-link fallback + scoped link interception) #541 hosting/ui: mount a legacy SPA under a prefix (strangler migration)

Add-on modules (antosubash/smpy_modules)

• ai: resolve_model() fails in standalone Celery workers (settings holder only installed by the web host) smpy_modules#100 ai: resolve_model() fails in Celery workers (bug, P0 for AI pipelines)
• billing: usage metering and period-based quota accounting (split from #87) smpy_modules#99 billing: usage metering and period quotas (split from fix: address scaffold and framework papercuts (#65–#85) #87)
• pagebuilder: working contact-form and newsletter blocks — submission storage, unsubscribe, admin (split from #88) smpy_modules#101 pagebuilder: working contact-form / newsletter blocks (split from fix: diagnostic false positives + Inertia 307 strip (#70) #88)

Checked and not filed:

• SMTP, verification and reset; body limits; health checks; Celery canvases and beat; CSP blob workers; partial reloads; layouts and dark mode; e2e harness. All of these exist.
• Python 3.12 floor: needs an image bump only.
• Vendor chunking: affects only the reference host, not the scaffold.
• Settings precedence and CI/release: already tracked (Module settings: a DB-stored value overrides its SM_<MODULE>_* env var #486, Scaffold template run_worker.py reads env only, ignoring DB-backed background_tasks settings #490, One invalid stored host setting crashes boot on every worker #497, Build-time HostSettings fields (multi_tenant, i18n_*, tenant_header) not marked requires_restart #499, make lint and CI are not equivalent (fresh-clone tsc failure, local-only checks, no Postgres suite / doctor in CI) #508, Release: no test gate, inconsistent package versions, CHANGELOG never cut from [Unreleased] #510).