Harden CI and background worker reliability

.github/workflows/ci.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches: ['**']
   pull_request:
+  schedule:
+    - cron: '17 2 * * *'
 
 permissions:
   contents: read
@@ -27,6 +29,8 @@ jobs:
           cache: npm
           cache-dependency-path: backend/package-lock.json
       - run: npm ci
+      - name: Audit backend dependencies
+        run: npm audit --audit-level=high
       - run: npm run typecheck
       - run: npm test
       - run: npm run build
@@ -45,6 +49,8 @@ jobs:
           cache: npm
           cache-dependency-path: frontend/package-lock.json
       - run: npm ci
+      - name: Audit frontend dependencies
+        run: npm audit --audit-level=high
       - run: npm run build
       - run: npx playwright install --with-deps chromium
       - run: npm run test:e2e
@@ -69,3 +75,59 @@ jobs:
           ANUBIS_ED25519_PRIVATE_KEY_HEX: '0000000000000000000000000000000000000000000000000000000000000001'
           GRAFANA_ADMIN_PASSWORD: ci-grafana-password
         run: docker compose config --quiet
+
+  secrets:
+    name: Secret scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Scan repository with gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  nightly-load:
+    name: Nightly realtime load
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: backend/package-lock.json
+      - name: Start realtime stack
+        env:
+          POSTGRES_PASSWORD: nightly-postgres-password
+          REDIS_PASSWORD: nightly-redis-password
+          JWT_SECRET: nightly-jwt-secret
+          OPERATOR_SITE_TOKEN: nightly-operator-token-0123456789abcdef0123456789abcdef
+          MQTT_PASSWORD: nightly-mqtt-password
+          GRAFANA_ADMIN_PASSWORD: nightly-grafana-password
+        run: docker compose up -d --build timescaledb redis mosquitto db-migrate backend
+      - name: Wait for readiness
+        run: |
+          for attempt in $(seq 1 60); do
+            if curl --fail --silent http://127.0.0.1:3000/readyz >/dev/null; then
+              exit 0
+            fi
+            sleep 2
+          done
+          docker compose logs backend
+          exit 1
+      - name: Run realtime load budget
+        working-directory: backend
+        run: |
+          npm ci
+          npm run load:realtime -- --duration 30 --concurrency 20 --slow-ws-clients 10 --max-p95-ms 1500
+      - name: Capture logs
+        if: always()
+        run: docker compose logs --no-color backend > nightly-backend.log
+      - uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: nightly-load-logs
+          path: nightly-backend.log