security: restrict CORS, add auth token, rate limiting, health endpoint, graceful shutdown

- Replace wildcard CORS with configurable TLSYNC_ALLOWED_ORIGINS env var
- Add TLSYNC_SECRET token validation on /connect/:roomId (401 if missing/wrong)
- Add in-memory rate limiter: max 20 connections per IP per 60s
- Add GET /health endpoint returning status + uptime
- Add SIGTERM/SIGINT graceful shutdown handlers
- Fix hardcoded Access-Control-Allow-Origin: * on uploads and unfurl routes
- Fix rooms.ts: import TLSchema/TLStore/TLStoreOptions from @tldraw/tlschema not tldraw
- Add @tldraw/tlschema 3.6.1 as direct dependency (was transitive, causing ENOENT crash)
- Add named tlsync-node-modules volume to docker-compose to prevent host mount shadowing image packages

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

docker-compose.yml

@@ -10,6 +10,8 @@ services:
       - LOG_PATH=/app/logs
       - PORT_TLDRAW_SYNC=5000
       - NODE_ENV=production
+      - TLSYNC_SECRET=${TLSYNC_SECRET}
+      - TLSYNC_ALLOWED_ORIGINS=${TLSYNC_ALLOWED_ORIGINS}
     ports:
       - "5000:5000"
     volumes:
@@ -18,6 +20,7 @@ services:
       - ./.assets:/app/.assets
       - ./.rooms:/app/.rooms
       - ./logs:/app/logs
+      - tlsync-node-modules:/app/node_modules
     networks:
       - cc-network
 
@@ -25,3 +28,6 @@ networks:
   cc-network:
     name: cc-network
     driver: bridge
+
+volumes:
+  tlsync-node-modules: