fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps),
tracked in deploy-k3s/SECURITY.md, plus fixes from two independent
post-remediation reviews.

Auth & sessions:
- SHA-256 hashed auth-token storage (C1); prior-token cache eviction on
  re-login (MEDIUM-1)
- local Google JWKS verification, iss/aud/exp checks (C2/C3)
- constant-time login + generic errors (L1/LIVE-L11/LIVE-L13)
- per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3)
- verified-email gating, login rate limiting (LIVE-L19, H1-H3)

IAP & webhooks:
- Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6)
- migrations 000003-000006 (token hashing, IAP replay, audit_log +
  webhook_event_log table creation, append-only audit log)

Authorization & races:
- file-ownership owner-OR-member fix (C7), atomic share-code join
  (C9/H9), device-token reassignment (C8/LOW-3)

Secrets & deploy:
- secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis
  password out of the ConfigMap (HIGH-1); B2 keys reconciled
- digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics
  lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban +
  unattended-upgrades at provision; secret-rotation runbook

Build, vet, and the full test suite (incl. -race) pass; the goose
migration chain is verified against PostgreSQL 16.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

cmd/worker/main.go

@@ -47,11 +47,13 @@ func main() {
 
 	// Initialize OpenTelemetry tracing for the worker process. Same OTLP
 	// destination as the api; service.name distinguishes them in Jaeger.
+	// config.SecretValue (not os.Getenv) so file-mounted secrets resolve
+	// after audit F8 removed these from the process environment.
 	tracingShutdown, err := tracing.Init(context.Background(), tracing.Config{
 		ServiceName: "honeydue-worker",
 		Environment: workerDeploymentEnv(cfg.Server.Debug),
-		EndpointURL: os.Getenv("OBS_TRACES_URL"),
-		BearerToken: os.Getenv("OBS_INGEST_TOKEN"),
+		EndpointURL: config.SecretValue("OBS_TRACES_URL"),
+		BearerToken: config.SecretValue("OBS_INGEST_TOKEN"),
 		SampleRatio: tracing.SampleRatioFromEnv(),
 	})
 	if err != nil {
@@ -106,6 +108,17 @@ func main() {
 	if err != nil {
 		log.Fatal().Err(err).Msg("Failed to parse Redis URL")
 	}
+	// Audit HIGH-1: the Redis password is a file-mounted secret (REDIS_PASSWORD),
+	// not embedded in REDIS_URL — REDIS_URL travels in the honeydue-config
+	// ConfigMap. Apply the password onto the parsed opt so the Asynq server,
+	// inspector and monitoring client (all derived from redisOpt below)
+	// authenticate against a requirepass-protected Redis.
+	if cfg.Redis.Password != "" {
+		if clientOpt, ok := redisOpt.(asynq.RedisClientOpt); ok {
+			clientOpt.Password = cfg.Redis.Password
+			redisOpt = clientOpt
+		}
+	}
 
 	// Initialize monitoring service (if Redis is available)
 	var monitoringService *monitoring.Service