fix architecture and write new tests

scripts/docker-prod-common.sh

@@ -53,13 +53,15 @@ read_env_value() {
 }
 
 validate_prod_env_file() {
-  local api_domain public_site_domain cors_origins pgmanage_domain portainer_domain
+  local api_domain public_site_domain cors_origins portainer_domain postgres_password redis_password jwt_secret
 
   api_domain="$(read_env_value API_DOMAIN)"
   public_site_domain="$(read_env_value PUBLIC_SITE_DOMAIN)"
   cors_origins="$(read_env_value CORS_ORIGINS)"
-  pgmanage_domain="$(read_env_value PGMANAGE_DOMAIN)"
   portainer_domain="$(read_env_value PORTAINER_DOMAIN)"
+  postgres_password="$(read_env_value POSTGRES_PASSWORD)"
+  redis_password="$(read_env_value REDIS_PASSWORD)"
+  jwt_secret="$(read_env_value JWT_SECRET)"
 
   if [[ -z "${api_domain}" || "${api_domain}" == *example.com* ]]; then
     echo "Invalid API_DOMAIN in ${ENV_FILE}. Set it to the real production API hostname, not example.com." >&2
@@ -76,10 +78,15 @@ validate_prod_env_file() {
     exit 1
   fi
 
-  if [[ -n "${pgmanage_domain}" && "${pgmanage_domain}" == *example.com* ]]; then
-    echo "Invalid PGMANAGE_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the pgmanage router." >&2
-    exit 1
-  fi
+  for pair in "POSTGRES_PASSWORD:${postgres_password}" "REDIS_PASSWORD:${redis_password}" "JWT_SECRET:${jwt_secret}"; do
+    key="${pair%%:*}"
+    value="${pair#*:}"
+    if [[ -z "${value}" || "${value}" == replace-with-* || "${value}" == *changeme* || "${value}" == *change-me* ]]; then
+      echo "Invalid ${key} in ${ENV_FILE}. Set a real production secret." >&2
+      exit 1
+    fi
+  done
+
 
   if [[ -n "${portainer_domain}" && "${portainer_domain}" == *example.com* ]]; then
     echo "Invalid PORTAINER_DOMAIN in ${ENV_FILE}. Set a real hostname or disable the portainer router." >&2