[P1][Compose] Secure default service bindings and authentication #794

Baseline

Verified on master commit 61b06b965265a1327b84a8c6b6d7de491d9db97e.

Problem

Compose publishes MongoDB, Dask and Jupyter on all host interfaces, MongoDB is unauthenticated, and Jupyter uses committed password mspass.

Impact

Default desktop deployment can expose data, computation and notebook access beyond the host.

Acceptance criteria

Bind every published port in every Compose topology to 127.0.0.1. Start MongoDB with --auth and require nonempty root credentials using Compose required-variable expressions ${MONGO_INITDB_ROOT_USERNAME:?} and ${MONGO_INITDB_ROOT_PASSWORD:?}; wire healthchecks/clients with authenticated access. Remove the fixed Jupyter password. By default let Jupyter generate a fresh per-launch token; allow an explicit nonempty JUPYTER_TOKEN environment value to override it.

Required tests

Run docker compose config with missing/empty credentials and require failure; inspect every resolved port binding; start each topology with credentials, reject unauthenticated Mongo access, verify authenticated health/client access, verify generated Jupyter tokens differ between launches, and verify explicit JUPYTER_TOKEN override.

Related

#185 was an old Jupyter login malfunction, not this security contract.