Pre-production hardening addressing all must-fix findings from a three-agent audit (security, fork remnants, robustness), plus fixes from a seven-reviewer /second-opinion pass (Claude specialty agents, pragma:security, GPT-5.6 Codex, Kimi K3). Changes: - Remove lemdro.id third-party fallback: prod server fails fast when PUBLIC_INSTANCE_URL is unset (even if PUBLIC_INTERNAL_INSTANCE is set, since the browser can only see the public var); API proxy returns 500 on empty instance - Stop handleError logging the full request event, which leaked the session cookie and sealed auth token into server logs; log only method/path/status/message/stack, pinned by new sanitization tests - Add AbortSignal timeouts to all server-side fetches: /api/me (10s), proxy upstream (30s with 504-vs-502 distinction), logout revocation (10s); proxy signal is created after the client body is read so slow uploads don't consume the upstream budget - Scope the prod HTTP opt-in: ALLOW_HTTP_INTERNAL_INSTANCE=true permits plaintext only to the PUBLIC_INTERNAL_INSTANCE origin (the Docker-network hop), never session-derived hosts - Fix markdown link XSS: protocol allowlist (http/https/mailto) via URL-parser normalization in isSafeHref, closing the java\tscript: regex-blocklist bypass; extracted to plugins.js with pinning tests - Surface backend-unreachable state: authError now flows through the layout to a user-facing toast instead of silently rendering logged-in users as logged out - Classify timeout/abort errors by error.name instead of message substrings; portable (non-DOMException) 504 detection - Delete dead Lemmy-era components (Subscribe, UserNote, CommunityFlair, RemoveModal, BanModal) and their modal state - 404-gate the unmigrated blocked-communities/instances routes; the blocks page keeps only the Coves-native users tab Deploy note: prod requires PUBLIC_INSTANCE_URL, PUBLIC_INTERNAL_INSTANCE (explicit http:// scheme), ALLOW_HTTP_INTERNAL_INSTANCE=true, and ORIGIN. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>