CRITICAL SECURITY: Disable debug output in production

- Add production environment configuration
- Force disable performance debug middleware in production
- Add ProductionSecurityMiddleware for route protection
- Update PerformanceServiceInitializer to check environment
- Add deployment script for production
- Update docker-compose with environment variables

This fixes the critical security issue of debug information
being exposed on the production site.

src/Framework/Http/Middlewares/ProductionSecurityMiddleware.php

@@ -0,0 +1,133 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Framework\Http\Middlewares;
+
+use App\Framework\Config\Environment;
+use App\Framework\Config\EnvKey;
+use App\Framework\Http\HttpMiddleware;
+use App\Framework\Http\JsonErrorResponse;
+use App\Framework\Http\MiddlewareContext;
+use App\Framework\Http\MiddlewarePriority;
+use App\Framework\Http\MiddlewarePriorityAttribute;
+use App\Framework\Http\Next;
+use App\Framework\Http\RequestStateManager;
+
+/**
+ * Middleware to block sensitive routes in production environment
+ */
+#[MiddlewarePriorityAttribute(MiddlewarePriority::EARLY)]
+final readonly class ProductionSecurityMiddleware implements HttpMiddleware
+{
+    /**
+     * Routes that should be blocked in production
+     */
+    private const BLOCKED_ROUTES = [
+        '/admin/discovery',
+        '/admin/routes',
+        '/admin/performance',
+        '/admin/environment',
+        '/debug',
+        '/performance',
+        '/api/debug'
+    ];
+
+    /**
+     * Routes that require IP whitelist in production
+     */
+    private const IP_RESTRICTED_ROUTES = [
+        '/admin',
+        '/analytics',
+        '/health',
+        '/metrics'
+    ];
+
+    /**
+     * Allowed IPs for admin access in production
+     */
+    private const ALLOWED_IPS = [
+        '127.0.0.1',
+        '::1',
+        // Add your office/home IP here for production admin access
+    ];
+
+    public function __construct(
+        private Environment $environment
+    ) {
+    }
+
+    public function __invoke(MiddlewareContext $context, Next $next, RequestStateManager $stateManager): MiddlewareContext
+    {
+        // Only apply restrictions in production
+        if ($this->environment->get(EnvKey::APP_ENV, 'production') !== 'production') {
+            return $next($context);
+        }
+
+        $path = $context->request->path ?? '/';
+        $clientIp = $context->request->server->getClientIp();
+
+        // Block sensitive debug routes completely in production
+        if ($this->isBlockedRoute($path)) {
+            return $context->withResponse(
+                new JsonErrorResponse(
+                    message: 'Not Found',
+                    statusCode: 404
+                )
+            );
+        }
+
+        // Check IP whitelist for admin routes
+        if ($this->isIpRestrictedRoute($path) && !$this->isAllowedIp($clientIp)) {
+            return $context->withResponse(
+                new JsonErrorResponse(
+                    message: 'Access Denied',
+                    statusCode: 403
+                )
+            );
+        }
+
+        return $next($context);
+    }
+
+    private function isBlockedRoute(string $path): bool
+    {
+        foreach (self::BLOCKED_ROUTES as $blockedRoute) {
+            if (str_starts_with($path, $blockedRoute)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private function isIpRestrictedRoute(string $path): bool
+    {
+        foreach (self::IP_RESTRICTED_ROUTES as $restrictedRoute) {
+            if (str_starts_with($path, $restrictedRoute)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private function isAllowedIp(?string $clientIp): bool
+    {
+        if ($clientIp === null) {
+            return false;
+        }
+
+        // Check if IP is in whitelist
+        if (in_array($clientIp, self::ALLOWED_IPS, true)) {
+            return true;
+        }
+
+        // Check if IP is from allowed environment variable
+        $allowedIpsEnv = $this->environment->get('ADMIN_ALLOWED_IPS', '');
+        if (!empty($allowedIpsEnv)) {
+            $allowedIps = array_map('trim', explode(',', $allowedIpsEnv));
+            return in_array($clientIp, $allowedIps, true);
+        }
+
+        return false;
+    }
+}

src/Framework/Logging/Formatter/LineFormatter.php

@@ -0,0 +1,9 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Framework\Logging\Formatter;
+
+final class LineFormatter
+{
+
+}

src/Framework/Logging/Formatter/LogFormatter.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Framework\Logging\Formatter;
+
+interface LogFormatter
+{
+
+}

src/Framework/Meta/MetaTag.php

@@ -0,0 +1,9 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Framework\Meta;
+
+final class MetaTag
+{
+
+}

src/Framework/Meta/MetaTagName.php

@@ -0,0 +1,10 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Framework\Meta;
+
+enum MetaTagType: string
+{
+    case NAME = 'name';
+    case PROPERTY = 'property';
+}

src/Framework/Meta/MetaTagProperty.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Framework\Meta;
+
+enum MetaTagProperty
+{
+
+}

src/Framework/Performance/Middleware/PerformanceDebugMiddleware.php

@@ -17,6 +17,8 @@ use App\Framework\Performance\Contracts\PerformanceCollectorInterface;
 use App\Framework\Performance\EnhancedPerformanceCollector;
 use App\Framework\Performance\PerformanceConfig;
 use App\Framework\Performance\PerformanceReporter;
+use App\Framework\Config\Environment;
+use App\Framework\Config\EnvKey;
 
 #[MiddlewarePriorityAttribute(MiddlewarePriority::LAST)]
 final readonly class PerformanceDebugMiddleware implements HttpMiddleware
@@ -24,7 +26,8 @@ final readonly class PerformanceDebugMiddleware implements HttpMiddleware
     public function __construct(
         private PerformanceCollectorInterface $collector,
         private PerformanceConfig $config,
-        private PerformanceReporter $reporter
+        private PerformanceReporter $reporter,
+        private Environment $environment
     ) {
     }
 
@@ -39,6 +42,16 @@ final readonly class PerformanceDebugMiddleware implements HttpMiddleware
 
     private function handlePerformanceOutput(MiddlewareContext $context, RequestStateManager $stateManager): MiddlewareContext
     {
+        // EMERGENCY SECURITY DISABLE: Force disable debug output immediately
+        // Until environment loading is fixed, completely disable debug output
+        return $context;
+        
+        // SECURITY: Never output debug info in production, regardless of config
+        $appEnv = $this->environment->get(EnvKey::APP_ENV, 'production');
+        if ($appEnv === 'production') {
+            return $context;
+        }
+        
         // Check if performance tracking is enabled
         if (! $this->config->enabled) {
             return $context;

src/Framework/Performance/PerformanceServiceInitializer.php

@@ -4,6 +4,8 @@ declare(strict_types=1);
 
 namespace App\Framework\Performance;
 
+use App\Framework\Config\Environment;
+use App\Framework\Config\EnvKey;
 use App\Framework\DI\Container;
 use App\Framework\DI\Initializer;
 use App\Framework\Performance\Contracts\PerformanceCollectorInterface;
@@ -13,7 +15,8 @@ use App\Framework\Performance\Contracts\PerformanceServiceInterface;
 final readonly class PerformanceServiceInitializer
 {
     public function __construct(
-        private Container $container
+        private Container $container,
+        private Environment $environment
     ) {
     }
 
@@ -23,14 +26,25 @@ final readonly class PerformanceServiceInitializer
         // Get the existing collector instance from container (registered in entry points)
         $collector = $this->container->get(PerformanceCollectorInterface::class);
 
+        // Performance debugging should NEVER be enabled in production
+        $appEnv = $this->environment->get(EnvKey::APP_ENV, 'production');
+        $isDebugEnabled = $this->environment->getBool(EnvKey::APP_DEBUG, false);
+        
+        // Strict check: Only enable in development AND debug mode
+        // Force disabled in production regardless of debug setting
+        $performanceEnabled = ($appEnv === 'development') && $isDebugEnabled;
+        
         $config = new PerformanceConfig(
-            enabled: true,
-            useEnhancedCollector: true,
+            enabled: $performanceEnabled,
+            detailedReports: $performanceEnabled, // Session info only in dev
+            useEnhancedCollector: $performanceEnabled,
+            includeStackTrace: false, // Never include stack traces
             thresholds: [
                 'slow_query_ms' => 100,
                 'slow_request_ms' => 1000,
                 'high_memory_mb' => 50,
-            ]
+            ],
+            excludedPaths: ['/health', '/metrics', '/api']
         );
 
         $reporter = new PerformanceReporter($collector);