feat: break-glass security reset

Implement dual-registry container publishing to both GHCR and Docker Hub
for maximum distribution reach. Add emergency security reset endpoint
("break-glass" mechanism) to recover from ACL lockout situations.

Key changes:

Docker Hub + GHCR dual publishing with Cosign signing and SBOM
Emergency reset endpoint POST /api/v1/emergency/security-reset
Token-based authentication bypasses Cerberus middleware
Rate limited (5/hour) with audit logging
30 new security enforcement E2E tests covering ACL, WAF, CrowdSec,
Rate Limiting, Security Headers, and Combined scenarios
Fixed container startup permission issue (tmpfs directory ownership)
Playwright config updated with testIgnore for browser projects
Security: Token via CHARON_EMERGENCY_TOKEN env var (32+ chars recommended)
Tests: 689 passed, 86% backend coverage, 85% frontend coverage

.docker/compose/docker-compose.e2e.yml

@@ -23,6 +23,9 @@ services:
       # Encryption key - MUST be provided via environment variable
       # Generate with: export CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)
       - CHARON_ENCRYPTION_KEY=${CHARON_ENCRYPTION_KEY:?CHARON_ENCRYPTION_KEY is required}
+      # Emergency reset token - for break-glass recovery when locked out by ACL
+      # Generate with: openssl rand -hex 32
+      - CHARON_EMERGENCY_TOKEN=${CHARON_EMERGENCY_TOKEN:-test-emergency-token-for-e2e-32chars}
       - CHARON_HTTP_PORT=8080
       - CHARON_DB_PATH=/app/data/charon.db
       - CHARON_FRONTEND_DIR=/app/frontend/dist
@@ -33,7 +36,8 @@ services:
       # FEATURE_CERBERUS_ENABLED deprecated - Cerberus enabled by default
     tmpfs:
       # True tmpfs for E2E test data - fresh on every run, in-memory only
-      - /app/data:size=100M,mode=1755
+      # mode=1777 allows any user to write (container runs as non-root)
+      - /app/data:size=100M,mode=1777
     healthcheck:
       test: ["CMD-SHELL", "curl -fsS http://localhost:8080/api/v1/health || exit 1"]
       interval: 5s

.docker/compose/docker-compose.playwright.yml

@@ -40,6 +40,9 @@ services:
       # Encryption key - MUST be provided via environment variable
       # Generate with: export CHARON_ENCRYPTION_KEY=$(openssl rand -base64 32)
       - CHARON_ENCRYPTION_KEY=${CHARON_ENCRYPTION_KEY:?CHARON_ENCRYPTION_KEY is required}
+      # Emergency reset token - for break-glass recovery when locked out by ACL
+      # Generate with: openssl rand -hex 32
+      - CHARON_EMERGENCY_TOKEN=${CHARON_EMERGENCY_TOKEN:-test-emergency-token-for-e2e-32chars}
       # Server settings
       - CHARON_HTTP_PORT=8080
       - CHARON_DB_PATH=/app/data/charon.db

.docker/docker-entrypoint.sh

@@ -42,6 +42,13 @@ mkdir -p /app/data/caddy 2>/dev/null || true
 mkdir -p /app/data/crowdsec 2>/dev/null || true
 mkdir -p /app/data/geoip 2>/dev/null || true
 
+# Fix ownership for directories created as root
+if is_root; then
+    chown -R charon:charon /app/data/caddy 2>/dev/null || true
+    chown -R charon:charon /app/data/crowdsec 2>/dev/null || true
+    chown -R charon:charon /app/data/geoip 2>/dev/null || true
+fi
+
 # ============================================================================
 # Plugin Directory Permission Verification
 # ============================================================================