release: v1.2.0 Production GA (single-node)

- known-limitations, deployment runbook, release checklist
- prod compose requires JWT secret; BARADB_ENV=production fail-closed
- scripts/backup-restore-drill.sh (backup → wipe → restore → verify)
- version bump 1.2.0 (nimble, Dockerfile, health, CHANGELOG dated)

src/barabadb/core/config.nim

@@ -250,6 +250,28 @@ proc loadConfig*(): BaraConfig =
   # 2. Environment overrides (highest priority)
   loadConfigFromEnv(result)
 
+proc isProductionEnv*(): bool =
+  ## True when BARADB_ENV=production (or prod) or BARADB_AUTH_REQUIRED=true.
+  let env = getEnv("BARADB_ENV", "").toLowerAscii()
+  if env == "production" or env == "prod": return true
+  parseEnvBool(getEnv("BARADB_AUTH_REQUIRED", ""), false)
+
+proc validateProductionConfig*(cfg: BaraConfig) =
+  ## Fail closed for production: auth on + non-empty JWT secret.
+  ## Call after loadConfig() from the main entrypoint.
+  if not isProductionEnv(): return
+  if not cfg.authEnabled:
+    raise newException(ValueError,
+      "Production refuses to start with auth disabled. " &
+      "Set BARADB_AUTH_ENABLED=true (or unset BARADB_ENV=production for local dev).")
+  if cfg.jwtSecret.len == 0:
+    raise newException(ValueError,
+      "Production refuses to start without BARADB_JWT_SECRET. " &
+      "Generate one: openssl rand -hex 32")
+  if cfg.jwtSecret in ["change-me", "change-me-to-random-32-char-string", "secret", "default"]:
+    raise newException(ValueError,
+      "Production refuses insecure JWT secret placeholder. Set a strong BARADB_JWT_SECRET.")
+
 proc getEffectiveJwtSecret*(cfg: BaraConfig): string =
   if cfg.jwtSecret.len > 0:
     return cfg.jwtSecret

src/barabadb/core/httpserver.nim

@@ -262,7 +262,7 @@ proc healthHandler(server: HttpServer): RequestHandler =
     let ctx = newContext(request)
     var body = %*{
       "status": "ok",
-      "version": "1.1.6"
+      "version": "1.2.0"
     }
     if server.raftNode != nil:
       let n = server.raftNode
@@ -368,7 +368,7 @@ proc openApiHandler(): RequestHandler =
     let ctx = newContext(request)
     ctx.json(%*{
       "openapi": "3.0.0",
-      "info": {"title": "BaraDB API", "version": "1.1.6"},
+      "info": {"title": "BaraDB API", "version": "1.2.0"},
       "paths": {
         "/query": {
           "post": {
@@ -906,7 +906,7 @@ function showTab(idx){
 }
 setInterval(() => { if(document.querySelectorAll('.panel')[4].classList.contains('active')) loadMetrics() }, 5000)
 </script>
-<div class='status' style='text-align:center;padding:10px'>BaraDB v1.1.6 — Multimodal Database Engine</div>
+<div class='status' style='text-align:center;padding:10px'>BaraDB v1.2.0 — Multimodal Database Engine</div>
 </body></html>"""
     request.respond(200, @[("Content-Type", "text/html; charset=utf-8")], html)