feat(auth): replace hand-rolled auth with Ory Kratos — phase 2 backend

Delegates all credential management (login, register, password reset,
email verification, social sign-in) to Ory Kratos. The Go API now acts
as a resource server: the new KratosAuth middleware validates sessions
against the Kratos whoami endpoint, writes the local User mirror into
Echo context, and all existing domain handlers continue working
unchanged. Hand-rolled token auth, AuthToken model, apple_auth/
google_auth services, and the auth refresh flow are removed. Tests are
updated to use the fake-token middleware pattern so existing integration
assertions require no rewrite.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/services/cache_service.go

@@ -12,7 +12,6 @@ import (
 	"github.com/rs/zerolog/log"
 
 	"github.com/treytartt/honeydue-api/internal/config"
-	"github.com/treytartt/honeydue-api/internal/models"
 )
 
 // CacheService provides Redis caching functionality
@@ -134,116 +133,6 @@ func (c *CacheService) Close() error {
 	return nil
 }
 
-// Auth token cache helpers
-const (
-	AuthTokenPrefix = "auth_token_"
-	TokenCacheTTL   = 5 * time.Minute
-)
-
-// authTokenCacheKey returns the Redis key for an auth token. The raw token
-// is hashed (audit C1) so the plaintext token never appears in a Redis key.
-func authTokenCacheKey(token string) string {
-	return AuthTokenPrefix + models.HashToken(token)
-}
-
-// CacheAuthToken caches a user ID for a token
-func (c *CacheService) CacheAuthToken(ctx context.Context, token string, userID uint) error {
-	return c.SetString(ctx, authTokenCacheKey(token), fmt.Sprintf("%d", userID), TokenCacheTTL)
-}
-
-// CacheAuthTokenWithCreated caches a user ID and token creation time for a token
-func (c *CacheService) CacheAuthTokenWithCreated(ctx context.Context, token string, userID uint, createdUnix int64) error {
-	return c.SetString(ctx, authTokenCacheKey(token), fmt.Sprintf("%d|%d", userID, createdUnix), TokenCacheTTL)
-}
-
-// GetCachedAuthToken gets a cached user ID for a token
-func (c *CacheService) GetCachedAuthToken(ctx context.Context, token string) (uint, error) {
-	val, err := c.GetString(ctx, authTokenCacheKey(token))
-	if err != nil {
-		return 0, err
-	}
-
-	var userID uint
-	_, err = fmt.Sscanf(val, "%d", &userID)
-	return userID, err
-}
-
-// GetCachedAuthTokenWithCreated gets a cached user ID and token creation time.
-// Returns userID, createdUnix, error. createdUnix is 0 if not stored (legacy format).
-func (c *CacheService) GetCachedAuthTokenWithCreated(ctx context.Context, token string) (uint, int64, error) {
-	val, err := c.GetString(ctx, authTokenCacheKey(token))
-	if err != nil {
-		return 0, 0, err
-	}
-
-	var userID uint
-	var createdUnix int64
-	n, _ := fmt.Sscanf(val, "%d|%d", &userID, &createdUnix)
-	if n < 1 {
-		return 0, 0, fmt.Errorf("invalid cached token format")
-	}
-	return userID, createdUnix, nil
-}
-
-// InvalidateAuthToken removes a cached token
-func (c *CacheService) InvalidateAuthToken(ctx context.Context, token string) error {
-	return c.Delete(ctx, authTokenCacheKey(token))
-}
-
-// InvalidateAuthTokenHashes removes cached entries for already-hashed token
-// keys. Unlike InvalidateAuthToken (which hashes a plaintext), this takes the
-// stored hash directly — used to evict a user's prior token on re-login
-// (audit MEDIUM-1), where the server no longer has the plaintext.
-func (c *CacheService) InvalidateAuthTokenHashes(ctx context.Context, hashes ...string) error {
-	keys := make([]string, 0, len(hashes))
-	for _, h := range hashes {
-		if h != "" {
-			keys = append(keys, AuthTokenPrefix+h)
-		}
-	}
-	if len(keys) == 0 {
-		return nil
-	}
-	return c.Delete(ctx, keys...)
-}
-
-// --- Per-account login-failure tracking (audit M5) ---
-
-const loginFailPrefix = "login_fail:"
-
-// RegisterLoginFailure records a failed login for an account from a given
-// source IP, and returns the number of DISTINCT source IPs that have failed
-// for this account within the window. Tracking distinct IPs as a set rather
-// than a raw counter (audit MEDIUM-3) means one attacker, from one IP, cannot
-// run the count up and lock a victim out by knowing only their email — a
-// single IP is bounded by the per-IP edge/app rate limiters instead. A
-// genuinely distributed credential-stuffing attack still trips the lockout.
-func (c *CacheService) RegisterLoginFailure(ctx context.Context, identifier, ip string, window time.Duration) (int64, error) {
-	key := loginFailPrefix + identifier
-	member := ip
-	if member == "" {
-		member = "unknown"
-	}
-	if err := c.client.SAdd(ctx, key, member).Err(); err != nil {
-		return 0, err
-	}
-	// Refresh the TTL on each failure: an active attack keeps the window
-	// open, while a quiet account ages out `window` after its last failure.
-	_ = c.client.Expire(ctx, key, window).Err()
-	return c.client.SCard(ctx, key).Result()
-}
-
-// LoginFailureIPCount returns how many distinct source IPs have failed to log
-// in to this account within the window (audit MEDIUM-3). SCard on a missing
-// key returns 0.
-func (c *CacheService) LoginFailureIPCount(ctx context.Context, identifier string) (int64, error) {
-	return c.client.SCard(ctx, loginFailPrefix+identifier).Result()
-}
-
-// ClearLoginFailures resets the failed-login IP set after a successful login.
-func (c *CacheService) ClearLoginFailures(ctx context.Context, identifier string) error {
-	return c.client.Del(ctx, loginFailPrefix+identifier).Err()
-}
 
 // Static data cache helpers
 const (