security: require auth on MongoDB and Redis

Enable mongod --auth with root credentials from MONGO_USER/PASSWORD,
and redis-server --requirepass from REDIS_PASSWORD. App connection
strings now embed credentials. All secrets are required (no fallback)
so misconfiguration fails fast at compose time.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

.env.unraid

@@ -1,26 +1,35 @@
 # ==========================================
 # Podcastic - Unraid Configuration
 # ==========================================
-# All services in single container on port 3579
 
 # Application Environment
 NODE_ENV=production
 
 # ==========================================
-# DATABASE & CACHE (Internal - Don't change)
+# DATABASE & CACHE — REQUIRED, set strong passwords
 # ==========================================
-MONGODB_URI=mongodb://127.0.0.1:27017/podcastic
-REDIS_URL=redis://127.0.0.1:6379
+# Generate strong passwords: openssl rand -base64 24
+MONGO_USER=podcastic
+MONGO_PASSWORD=CHANGE_ME_strong_random_password
+REDIS_PASSWORD=CHANGE_ME_strong_random_password
+
+# These are derived from the credentials above (do not edit unless you know what you're doing)
+MONGODB_URI=mongodb://podcastic:CHANGE_ME_strong_random_password@mongodb:27017/podcastic?authSource=admin
+REDIS_URL=redis://:CHANGE_ME_strong_random_password@redis:6379
 
 # ==========================================
-# SECURITY - CHANGE THESE!
+# SECURITY — REQUIRED
 # ==========================================
-# JWT Secret - Use strong random string
+# JWT Secret — minimum 32 chars, must be a strong random string
 # Generate: openssl rand -base64 32
-JWT_SECRET=change-this-to-random-secret-key-in-production
+JWT_SECRET=
 JWT_EXPIRES_IN=7d
 JWT_REFRESH_EXPIRES_IN=30d
 
+# CORS — comma-separated list of frontend origins (e.g. https://podcastic.your-domain.com)
+# Leave empty only if frontend and backend share the same origin
+CORS_ORIGIN=
+
 # ==========================================
 # OPTIONAL: PodcastIndex API (Podcast Search)
 # ==========================================
@@ -30,26 +39,16 @@ PODCAST_INDEX_API_KEY=
 PODCAST_INDEX_API_SECRET=
 
 # ==========================================
-# PORTS (Single container)
+# PORTS
 # ==========================================
 # Frontend: http://your-unraid-ip:3579
 # API: http://your-unraid-ip:3579/api
-# Health: http://your-unraid-ip:3579/health
-
-PORT=5000  # Internal backend port (don't change)
-
-# ==========================================
-# Frontend Configuration
-# ==========================================
-VITE_API_URL=http://your-unraid-ip:3579/api
-# Or use relative path:
-# VITE_API_URL=/api
+PORT=3579
 
 # ==========================================
 # NOTES FOR UNRAID
 # ==========================================
-# 1. Change JWT_SECRET to a random string
-# 2. If accessing from WAN, update VITE_API_URL to your domain
+# 1. Generate strong passwords with: openssl rand -base64 32
+# 2. Set CORS_ORIGIN to your public frontend URL if accessing from WAN
 # 3. Optionally add PodcastIndex API keys for search feature
 # 4. All data stored in /mnt/user/appdata/podcastic/
-# 5. Logs in /mnt/user/appdata/podcastic/logs/