Rebuild profile router as secure recoverable v2

deploy/mike-ai-profile-router.service

@@ -8,8 +8,14 @@ Type=simple
 ExecStart=/opt/mike-ai/ai-profile-router/venv/bin/python /opt/mike-ai/ai-profile-router/ai_profile_router.py
 Restart=on-failure
 RestartSec=3
+EnvironmentFile=-/etc/mike-ai/router.env
 Environment=ROUTER_HOST=0.0.0.0
 Environment=ROUTER_PORT=8081
+Environment=ROUTER_AUTH_MODE=required
+Environment=ROUTER_API_KEY_FILE=/etc/mike-ai/router-api-key
+Environment=ROUTER_STATE_FILE=/var/lib/mike-ai-profile-router/state.json
+Environment=ROUTER_PROFILES_FILE=/etc/mike-ai/router-profiles.json
+Environment=ROUTER_MAX_CONCURRENT_REQUESTS=16
 Environment=UPSTREAM_URL=http://127.0.0.1:8080
 Environment=PROFILE_SCRIPT=/usr/local/bin/llama-profile
 Environment=PROFILE_DIR=/etc/systemd/system/mike-ai-llama-ui.service.d
@@ -22,6 +28,9 @@ Environment=IMAGE_DIR=/opt/mike-ai/ai-profile-router/images
 Environment=IMAGE_WORKER_LOG=/opt/mike-ai/ai-profile-router/worker.log
 Environment=IMAGE_GEN_TIMEOUT=600
 Environment=IMAGE_VRAM_FREE_TIMEOUT=120
+Environment=IMAGE_RETENTION_FILES=100
+Environment=IMAGE_RETENTION_BYTES=5368709120
+Environment=IMAGE_RETENTION_DAYS=30
 Environment=LLAMA_SERVER_BIN=/opt/mike-ai/llama.cpp/build/bin/llama-server
 Environment=VISION_MODEL=/opt/mike-ai/models/qwen3.8-27b/Qwen3.8-27B-Q3_K_M.gguf
 Environment=VISION_MMPROJ=/opt/mike-ai/models/qwen3.8-27b-nvfp4/mmproj-BF16.gguf
@@ -31,9 +40,20 @@ Environment=VISION_LOAD_TIMEOUT=300
 Environment=VISION_INFER_TIMEOUT=300
 Environment=VISION_UNLOAD_TIMEOUT=120
 Environment=VISION_MAX_TOKENS=4096
+Environment=VISION_MAX_IMAGE_BYTES=20971520
+Environment=VISION_ALLOW_REMOTE_URLS=false
 Environment=VISION_LOG=/opt/mike-ai/ai-profile-router/vision_server.log
 NoNewPrivileges=true
 PrivateTmp=true
+ProtectHome=true
+ProtectKernelLogs=true
+ProtectKernelModules=true
+ProtectKernelTunables=true
+ProtectControlGroups=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+UMask=0077
 
 [Install]
 WantedBy=multi-user.target