feat(asr-pipeline): merge PR #1 webauth/CSRF/locking hardening and web_password fallback

servers/tools-pve/asr-pipeline/compose.yaml

@@ -27,8 +27,8 @@ x-asr-environment: &asr-environment
 
 services:
   asr-web:
-    image: tools-asr-pipeline:2026-11-02
-    pull_policy: never
+    image: ${ASR_IMAGE:-tools-asr-pipeline:latest}
+    pull_policy: ${ASR_PULL_POLICY:-never}
     build:
       context: .
       dockerfile: Dockerfile
@@ -38,12 +38,10 @@ services:
       <<: *asr-environment
       ASR_ROLE: web
     ports:
-      - "192.168.50.49:8788:8788"
+      - "${ASR_BIND_ADDRESS:-192.168.50.49}:${ASR_PORT:-8788}:8788"
     volumes:
-      - /mnt/truenas/personal/ASR-Pipeline:/data
-      - /opt/asr-pipeline/state:/state
-      - /opt/asr-pipeline/vault:/data/vault
-      - /opt/asr-pipeline/ssh:/root/.ssh:ro
+      - ${ASR_DATA_VOLUME:-/mnt/truenas/personal/ASR-Pipeline}:/data
+      - ${ASR_STATE_VOLUME:-/opt/asr-pipeline/state}:/state
     healthcheck:
       test: ["CMD", "curl", "-fsS", "http://127.0.0.1:8788/health"]
       interval: 30s
@@ -54,8 +52,8 @@ services:
       - no-new-privileges:true
 
   asr-worker:
-    image: tools-asr-pipeline:2026-11-02
-    pull_policy: never
+    image: ${ASR_IMAGE:-tools-asr-pipeline:latest}
+    pull_policy: ${ASR_PULL_POLICY:-never}
     container_name: tools-asr-worker
     restart: unless-stopped
     environment:
@@ -63,10 +61,8 @@ services:
       ASR_ROLE: worker
     command: ["python", "-m", "asrservice.worker"]
     volumes:
-      - /mnt/truenas/personal/ASR-Pipeline:/data
-      - /opt/asr-pipeline/state:/state
-      - /opt/asr-pipeline/vault:/data/vault
-      - /opt/asr-pipeline/ssh:/root/.ssh:ro
+      - ${ASR_DATA_VOLUME:-/mnt/truenas/personal/ASR-Pipeline}:/data
+      - ${ASR_STATE_VOLUME:-/opt/asr-pipeline/state}:/state
     healthcheck:
       test: ["CMD", "python", "-m", "asrservice.healthcheck"]
       interval: 30s