Harden render server and import boundaries

README.md

@@ -68,6 +68,34 @@ npm run desktop:build  # build platform installer/package artifacts into release
 app without creating an installer. `desktop:build` uses `electron-builder` and
 targets AppImage on Linux, NSIS on Windows, and DMG on macOS.
 
+## MP4 render server
+
+MP4 export is handled by the optional render server in `server/`. It binds to
+`127.0.0.1:6000` by default and requires a token before it will accept render
+jobs.
+
+```bash
+cd server
+npm ci
+HOST=127.0.0.1 PORT=6000 RENDER_TOKEN="choose-a-long-random-token" npm start
+```
+
+Point the app at the server with matching Vite env values:
+
+```bash
+VITE_RENDER_SERVER=http://localhost:6000 VITE_RENDER_TOKEN="choose-a-long-random-token" npm run dev
+```
+
+The server exposes `HOST=0.0.0.0` only when explicitly requested. If you expose
+it beyond localhost, set `RENDER_ALLOWED_ORIGINS` to the exact app origins that
+should be allowed. Chromium sandboxing stays enabled by default; use
+`CHROME_NO_SANDBOX=1` only for a deployment environment that cannot run the
+sandbox.
+
+The included `docker-compose.yml` keeps the published host port on
+`127.0.0.1:6000` and requires `RENDER_TOKEN` in the environment before it will
+start.
+
 ## Stack
 
 - Vue 3 (`<script setup>`) + Pinia state