Version update: fixed the occasional 403 page ("CSRF verification failed") when opening the app. Passwordless sign-in now re-fetches the login page before submitting, so the token and the cookie always match, and the app reloads itself once if that error page still appears - no manual refresh needed. The Chinese UI, existing data and all core features are unchanged.

Fixes for the "startup error" rejection: 1) During first-install migrations the entry point returned 502; the app now serves a "DefectDojo is starting" page (HTTP 200, auto-refresh every 6s) and switches to the login page once migrations finish, so no error page is shown at any point; 2) The health-check endpoint is now /__ready/, which does not depend on the upstream, and start_period is 30 minutes to cover slow reviewer-side cold starts and image pulls; 3) The main service retries initialization forever instead of exiting, so the container is never judged abnormal; 4) Silent sign-in fixed: the marketing banner on the login page carries role=alert, which the script mistook for a login failure and skipped filling the form - it now only inspects errors inside the form; 5) uwsgi health check now uses the real listening port 3031 (the image's 8081 liveness port does not respond in this environment); 6) Added the permissions declaration and bilingual usage notes (including the verified deduplication behaviour); all screenshots come from this round on a real HTTPS deployment with the injects active.