deploy validated production runtime

docs/quality/evidence/qa-coolify-deployment-runtime.json

@@ -0,0 +1,25 @@
+{
+  "checkedAt": "2026-09-06T17:30:38.609Z",
+  "source": "Coolify API + live read-only probe",
+  "applicationUuid": "xz6p64cit26n02wzhh0orupy",
+  "deploymentUuid": "tkairlz3breabienx9pkw3d7",
+  "giteaMain": "4e9862680b3486cb554789e2d1eb0e552c6f7626",
+  "deploymentStatus": "finished",
+  "live": {
+    "base": "https://ihaleist.com",
+    "pass": true,
+    "readyStatus": 200,
+    "healthStatus": 200,
+    "missingHeaders": []
+  },
+  "bundleVerification": {
+    "main": "/assets/index-BIrKOH25.js",
+    "calendar": "/assets/TenderCalendar-TZInjoIh.js",
+    "strings": [
+      "Google Takvim (saat gerekli)",
+      "yenileme sonrası yeniden yüklenir"
+    ]
+  },
+  "readOnly": true,
+  "scope": "No authentication, data writes, payments, messages, or tender submissions were performed."
+}

docs/quality/evidence/qa-live-runtime.json

@@ -1,30 +1,30 @@
 {
   "base": "https://ihaleist.com",
   "readOnly": true,
-  "checkedAt": "2026-09-06T17:18:22.511Z",
+  "checkedAt": "2026-09-06T17:30:38.609Z",
   "checks": {
     "home": {
       "status": 200,
       "contentType": "text/html",
       "headers": {
-        "x-content-type-options": null,
+        "x-content-type-options": "nosniff",
-        "referrer-policy": null,
+        "referrer-policy": "no-referrer",
-        "permissions-policy": null,
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
-        "x-frame-options": null,
+        "x-frame-options": "DENY",
-        "content-security-policy": null,
+        "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com",
-        "strict-transport-security": null
+        "strict-transport-security": "max-age=31536000; includeSubDomains"
       }
     },
     "health": {
       "status": 200,
       "contentType": "application/json; charset=utf-8",
       "headers": {
-        "x-content-type-options": null,
+        "x-content-type-options": "nosniff",
-        "referrer-policy": null,
+        "referrer-policy": "no-referrer",
-        "permissions-policy": null,
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
-        "x-frame-options": null,
+        "x-frame-options": "DENY",
-        "content-security-policy": null,
+        "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com",
-        "strict-transport-security": null
+        "strict-transport-security": "max-age=31536000; includeSubDomains"
       },
       "json": {
         "ok": true
@@ -32,30 +32,31 @@
       "apiSuccess": true
     },
     "ready": {
-      "status": 404,
+      "status": 200,
       "contentType": "application/json; charset=utf-8",
       "headers": {
-        "x-content-type-options": null,
+        "x-content-type-options": "nosniff",
-        "referrer-policy": null,
+        "referrer-policy": "no-referrer",
-        "permissions-policy": null,
+        "permissions-policy": "camera=(), microphone=(), geolocation=()",
-        "x-frame-options": null,
+        "x-frame-options": "DENY",
-        "content-security-policy": null,
+        "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; script-src 'self' https://accounts.google.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: blob: https:; connect-src 'self' https:; worker-src 'self' blob:; frame-src 'self' https://accounts.google.com",
-        "strict-transport-security": null
+        "strict-transport-security": "max-age=31536000; includeSubDomains"
       },
       "json": {
-        "success": false,
+        "ok": true,
-        "error": "not found"
+        "ready": true,
+        "checks": {
+          "userData": {
+            "ok": true
+          },
+          "sharedData": {
+            "ok": true
+          }
+        }
       },
-      "apiSuccess": false
+      "apiSuccess": true
     }
   },
-  "pass": false,
+  "pass": true,
-  "missingHeaders": [
+  "missingHeaders": []
-    "x-content-type-options",
-    "referrer-policy",
-    "permissions-policy",
-    "x-frame-options",
-    "content-security-policy",
-    "strict-transport-security"
-  ]
 }

docs/quality/uygulama-durumu.md

@@ -2360,3 +2360,7 @@ Doğrulama: browser QA `icsPersistsAfterReload`, `accountScopedIcs` ve `primaryI
 ### 2026-09-06 · Production deploy erişim engeli
 
 Yerel doğrulaması tamamlanan dal `e5284a6` commit'inde; Coolify'ın kaynak aldığı Gitea `main` ise `909ebae` commit'inde ve yerel dalın 464 commit gerisinde. Gitea HTTPS push denemesi kullanıcı adı, SSH push denemesi ise public key bulunamadığı için reddedildi. Bu nedenle Coolify henüz yeni imajı oluşturmadı; canlı drift probe'u eski `/api/ready` 404 ve eksik güvenlik başlıklarını göstermeye devam ediyor. Üretim değişikliği için Gitea/Coolify oturumunda kimlik doğrulama ve Redeploy adımı bekleniyor.
+
+### 2026-09-06 · Coolify production deployment tamamlandı
+
+Gitea `main` güncellenerek `4e986268` commit'ine alındı. Coolify `ihaleist` deployment kaydı `tkairlz3breabienx9pkw3d7` `finished` durumuna geçti. Salt okunur canlı probe artık `/api/health` ve `/api/ready` için 200/`ok:true`, altı güvenlik başlığının tamamı ve canlı bundle içinde yeni takvim davranışlarını doğruluyor. Kanıt: [`qa-coolify-deployment-runtime.json`](evidence/qa-coolify-deployment-runtime.json) ve [`qa-live-runtime.json`](evidence/qa-live-runtime.json).