- Password minimum increased from 8 to 12 characters - CORS configurable via CORS_ORIGINS env var (comma-separated whitelist) - Pagination empty string q param handled via preprocess - Request timeout set to 30 seconds - Log file output via LOG_FILE env var (stdout + file in production) - Pino-pretty in development, JSON to stdout + file in production