Security validations, Compose hardening, integration tests, and DX improvements

[smeinecke]

Summary

This PR addresses real gaps in configuration validation, deployment defaults, test coverage, and developer experience.

Security & correctness

• Minimum SECRET length (32 chars) -- parseApiConfig now rejects one-character secrets that were silently accepted before.
• ALGORITHM whitelist -- Only PBKDF2/SHA-256, PBKDF2/SHA-384, and PBKDF2/SHA-512 are accepted. Typos like SHA-256 now fail fast with a clear error instead of producing broken challenges.
• Distinguishable /verify errors -- Returns 417 with { error: "invalid" } or { error: "replayed" } so clients can debug without guessing.

Production & deployment

• Demo as opt-in Compose profile -- docker compose up --build now starts only the API. Use --profile demo to include the demo service.
• Restart policy -- unless-stopped on both services for automatic recovery.
• Resource limits -- 256M memory and 0.5 CPU caps to keep the scheduler friendly during traffic spikes.

Test coverage

• Integration tests for api-app.ts -- New src/api-app.test.ts spins up the full Express app on an ephemeral port and exercises GET /, GET /challenge, and GET /verify (valid, invalid, missing, replayed) using Bun-native fetch.

Developer experience

• bunfig.toml -- Test discovery is now explicit and shell-independent.
• Request logging -- Lightweight METHOD path status duration middleware (disabled when NODE_ENV=test).