fix: production deployment — Docker, Nomad, Consul KV, SHA tags
- Dockerfile: multi-stage build, non-root user, src/static tracked with .gitkeep
- Nomad job: force_pull=true, Traefik router fixed to tink-demo.i80.dk,
loadbalancer.server.port=8000, job renamed from moneycapp-tink-demo
- CI/CD: git SHA image tags (deterministic deploys), removed .env.production
baking — secrets injected at runtime via Consul KV template stanza
- Session security: asyncio lock prevents duplicate code exchange on callback,
guard for already-stored token, api_log moved server-side (cookie overflow fix)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
bf61790465