- Dockerfile: Pin golang and alpine base images to sha256 digests
- Dockerfile: Pin golangci-lint to v2.10.1 and goimports to v0.42.0
- CI workflows already pinned to commit SHAs (no changes needed)
- Generate random 32-byte session secret if not set via env var
- Persist to $UPAAS_DATA_DIR/session.key for container restarts
- Load existing secret from file on subsequent startups
- Change container data directory to /var/lib/upaas