fix: security audit remediation — Django settings + payment gateway API

- ALLOWED_HOSTS: wildcard replaced with explicit domain list (#15)
- CORS_ALLOWED_ORIGINS: added app.eventifyplus.com (#16)
- CSRF_TRUSTED_ORIGINS: added app.eventifyplus.com (#18)
- JWT ACCESS_TOKEN_LIFETIME: 1 day reduced to 30 minutes (#19)
- ROTATE_REFRESH_TOKENS enabled
- SECRET_KEY: removed unsafe fallback, crash on missing env var
- Added ActivePaymentGatewayView for dynamic gateway config (#1, #5, #20)
- Added PaymentGatewaySettingsView CRUD for admin panel

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

eventify/settings.py

@@ -3,7 +3,7 @@ from pathlib import Path
 
 BASE_DIR = Path(__file__).resolve().parent.parent
 
-SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY', 'change-me-in-production')
+SECRET_KEY = os.environ['DJANGO_SECRET_KEY']
 
 # DEBUG = os.environ.get('DJANGO_DEBUG', 'False') == 'True'
 #
@@ -12,7 +12,13 @@ SECRET_KEY = os.environ.get('DJANGO_SECRET_KEY', 'change-me-in-production')
 DEBUG = False
 
 ALLOWED_HOSTS = [
-    '*'
+    'db.eventifyplus.com',
+    'uat.eventifyplus.com',
+    'backend.eventifyplus.com',
+    'admin.eventifyplus.com',
+    'app.eventifyplus.com',
+    'localhost',
+    '127.0.0.1',
 ]
 
 INSTALLED_APPS = [
@@ -58,6 +64,9 @@ MIDDLEWARE = [
 ]
 
 CORS_ALLOWED_ORIGINS = [
+    "https://app.eventifyplus.com",
+    "https://admin.eventifyplus.com",
+    "https://uat.eventifyplus.com",
     "http://localhost:5178",
     "http://localhost:5179",
     "http://localhost:5173",
@@ -107,7 +116,6 @@ DATABASES = {
 #         'ENGINE': 'django.db.backends.postgresql',
 #         'NAME': 'eventify_uat_db',      # your DB name
 #         'USER': 'eventify_uat',          # your DB user
-#         'PASSWORD': 'eventifyplus@!@#$',  # your DB password
 #         'HOST': '0.0.0.0',       # or IP/domain
 #         'PORT': '5440',            # default PostgreSQL port
 #     }
@@ -148,6 +156,8 @@ SUMMERNOTE_THEME = 'bs5'
 
 # Reverse proxy / CSRF fix
 CSRF_TRUSTED_ORIGINS = [
+    'https://app.eventifyplus.com',
+    'https://admin.eventifyplus.com',
     'https://db.eventifyplus.com',
     'https://uat.eventifyplus.com',
     'https://test.eventifyplus.com',
@@ -170,8 +180,9 @@ REST_FRAMEWORK = {
 }
 
 SIMPLE_JWT = {
-    'ACCESS_TOKEN_LIFETIME': timedelta(days=1),
+    'ACCESS_TOKEN_LIFETIME': timedelta(minutes=30),  # Reduced from 1 day for security
     'REFRESH_TOKEN_LIFETIME': timedelta(days=7),
+    'ROTATE_REFRESH_TOKENS': True,
     'AUTH_HEADER_TYPES': ('Bearer',),
     'USER_ID_FIELD': 'id',
     'USER_ID_CLAIM': 'user_id',