🛡️ Sentinel: [HIGH] Fix Server-Side Request Forgery in IMAP connections

🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

docs/DeploymentGuide.md

@@ -349,18 +349,16 @@ workdir:
 
 ## Scaling
 
-DocuElevate is designed for horizontal scaling.  Both API and worker pods are stateless and can be scaled independently.
-
 ### Docker Compose
 
-Scale workers (task processing) and API pods (request handling) independently:
+Add more worker containers:
 
-```bash
-docker compose up -d --scale worker=3 --scale api=2
+```yaml
+worker:
+  deploy:
+    replicas: 3
 ```
 
-> **Note:** The `beat` service (Celery Beat scheduler) must always run as exactly **one** instance.  Do not scale it.  It publishes periodic tasks to the Redis broker; workers pick them up.
-
 ### Kubernetes / Helm
 
 Enable HPA:
@@ -379,15 +377,13 @@ worker:
     maxReplicas: 10
 ```
 
-The Helm chart deploys a separate **beat** pod (always 1 replica, `Recreate` strategy) so that scheduled tasks are never duplicated when workers scale.
-
 ---
 
 ## Monitoring
 
 - **Docker Compose**: `docker-compose logs -f`, `docker stats`
 - **Kubernetes**: `kubectl logs -l app.kubernetes.io/component=api -f`
-- **Prometheus / Grafana**: Scrape the `/api/diagnostic/healthz/ready` endpoint for readiness; add custom metrics as needed.
+- **Prometheus / Grafana**: Scrape the `/api/health` endpoint for readiness; add custom metrics as needed.
 - **Uptime Kuma**: Set `UPTIME_KUMA_URL` to your push URL for heartbeat monitoring.
 
 ---