Xavfsizlik

• Secretlar DB’da emas — provider credentials faqat env:/vault:// reference.
• Ikki auth plane — admin (parol, JWT) va client (consumer identity verify). Aralashmaydi.
• Service API gateway ortida — yuborish endpointi ishonchli tarmoqda ochiladi.
• PII maskalash — log/payload’da telefon/email masklanadi (+9989***4567).
• Prod’da almashtiring — ADMIN_PASSWORD, AUTH_JWT_SECRET default’lari faqat dev uchun.