refactor: remove deploy.cmd and update Dockerfile for health checks

- Deleted the deploy.cmd script as it was no longer needed.
- Updated Dockerfile to include curl for health checks and added a non-root user for improved security.
- Modified health check command to use curl for better reliability.
- Adjusted docker-compose.test.yml to reflect changes in health check configuration.
- Cleaned up appsettings.json and removed unused configuration properties.
- Removed Resource entity and related requests from the codebase as part of the architectural shift.
- Updated documentation to reflect the removal of hardware binding and related endpoints.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/02_document/tests/performance-tests.md

@@ -1,5 +1,7 @@
 # Performance Tests
 
+> **Cycle 1 update (2026-05-13)**: NFT-PERF-02 and NFT-PERF-03 (encrypted resource download, small/large file) were removed because the OTA / encrypted-resource-download endpoints (`POST /resources/get/...`) and the hardware-binding flow they depended on were reverted in cycle 1 (AZ-183 OTA revert, AZ-197 hardware removal). When OTA returns under the new architecture, perf scenarios for it must be re-derived from the new endpoints.
+
 ### NFT-PERF-01: Login Endpoint Latency
 
 **Summary**: Login endpoint responds within acceptable latency under normal load.
@@ -7,77 +9,46 @@
 **Metric**: Response time (p95)
 
 **Preconditions**:
-- System running with seed data
-- 10 concurrent users
+- System running with seed data (admin user from `e2e/db-init/99_test_seed.sql`)
+- 10 concurrent virtual users
 
 **Steps**:
 
 | Step | Consumer Action | Measurement |
 |------|----------------|-------------|
-| 1 | Send 100 login requests (10 concurrent) | Measure p50, p95, p99 response times |
+| 1 | 10 VUs send POST /login for 30s | Measure p50, p95, p99 response times |
 
 **Pass criteria**: p95 latency < 500ms
 **Duration**: 30 seconds
 
 ---
 
-### NFT-PERF-02: Resource Download Latency (Small File)
-
-**Summary**: Encrypted resource download for a small file (1 KB) completes quickly.
-**Traces to**: AC-14
-**Metric**: Response time including encryption
-
-**Preconditions**:
-- 1 KB test file uploaded
-- User authenticated with bound hardware
-
-**Steps**:
-
-| Step | Consumer Action | Measurement |
-|------|----------------|-------------|
-| 1 | Send 50 encrypted download requests (5 concurrent) | Measure p50, p95 response times |
-
-**Pass criteria**: p95 latency < 1000ms
-**Duration**: 30 seconds
-
----
-
-### NFT-PERF-03: Resource Download Latency (Large File)
-
-**Summary**: Encrypted resource download for a larger file (50 MB) completes within limits.
-**Traces to**: AC-13, AC-14
-**Metric**: Response time including encryption + transfer
-
-**Preconditions**:
-- 50 MB test file uploaded
-- User authenticated with bound hardware
-
-**Steps**:
-
-| Step | Consumer Action | Measurement |
-|------|----------------|-------------|
-| 1 | Send 5 sequential encrypted download requests | Measure p50, p95 response times |
-
-**Pass criteria**: p95 latency < 30000ms (30s)
-**Duration**: 3 minutes
-
----
-
 ### NFT-PERF-04: User List Endpoint Under Load
 
-**Summary**: User list endpoint responds within limits when DB has many users.
-**Traces to**: AC-9
-**Metric**: Response time
+**Summary**: `GET /users` responds within limits when DB has many users.
+**Traces to**: AC-11
+
+> **Note**: this scenario originally referenced AC-9. Post-cycle-1, AC-9 is "Registration rejects duplicate email". The user-listing criterion is AC-11 (filter support). The thresholds below verify the listing path under volume; the filter semantics are covered by functional tests.
+
+**Metric**: Response time (p95)
 
 **Preconditions**:
-- 500 users in database
-- Caller is ApiAdmin
+- Database seeded with 500 users (perf seed inserts dummy rows alongside the functional seed; see `scripts/run-performance-tests.sh`)
+- Caller is `admin@azaion.com` (ApiAdmin)
 
 **Steps**:
 
 | Step | Consumer Action | Measurement |
 |------|----------------|-------------|
-| 1 | Send 50 GET /users requests (10 concurrent) | Measure p50, p95 response times |
+| 1 | 10 VUs send GET /users for 30s, sharing one cached JWT | Measure p50, p95, p99 response times |
 
 **Pass criteria**: p95 latency < 1000ms
 **Duration**: 30 seconds
+
+---
+
+## Runner
+
+Both scenarios are implemented in `scripts/perf-scenarios.js` (k6, JS) and orchestrated by `scripts/run-performance-tests.sh`. The runner spins up the SUT via `docker-compose.test.yml`, seeds 500 perf users into `test-db`, executes k6, captures the JSON summary to `e2e/test-results/perf-summary.json`, and tears down.
+
+To run locally: `./scripts/run-performance-tests.sh`. Requires `k6` (`brew install k6`) and Docker.