fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps),
tracked in deploy-k3s/SECURITY.md, plus fixes from two independent
post-remediation reviews.

Auth & sessions:
- SHA-256 hashed auth-token storage (C1); prior-token cache eviction on
  re-login (MEDIUM-1)
- local Google JWKS verification, iss/aud/exp checks (C2/C3)
- constant-time login + generic errors (L1/LIVE-L11/LIVE-L13)
- per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3)
- verified-email gating, login rate limiting (LIVE-L19, H1-H3)

IAP & webhooks:
- Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6)
- migrations 000003-000006 (token hashing, IAP replay, audit_log +
  webhook_event_log table creation, append-only audit log)

Authorization & races:
- file-ownership owner-OR-member fix (C7), atomic share-code join
  (C9/H9), device-token reassignment (C8/LOW-3)

Secrets & deploy:
- secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis
  password out of the ConfigMap (HIGH-1); B2 keys reconciled
- digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics
  lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban +
  unattended-upgrades at provision; secret-rotation runbook

Build, vet, and the full test suite (incl. -race) pass; the goose
migration chain is verified against PostgreSQL 16.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/services/auth_refresh_test.go

@@ -75,9 +75,9 @@ func TestRefreshToken_FreshToken_ReturnsExisting(t *testing.T) {
 
 	svc := newTestAuthService(db)
 
-	resp, err := svc.RefreshToken(context.Background(), token.Key, user.ID)
+	resp, err := svc.RefreshToken(context.Background(), token.Plaintext, user.ID)
 	require.NoError(t, err)
-	assert.Equal(t, token.Key, resp.Token, "fresh token should return the same token")
+	assert.Equal(t, token.Plaintext, resp.Token, "fresh token should return the same token")
 	assert.Contains(t, resp.Message, "still valid")
 }
 
@@ -88,23 +88,25 @@ func TestRefreshToken_InRenewalWindow_ReturnsNewToken(t *testing.T) {
 
 	svc := newTestAuthService(db)
 
-	resp, err := svc.RefreshToken(context.Background(), token.Key, user.ID)
+	resp, err := svc.RefreshToken(context.Background(), token.Plaintext, user.ID)
 	require.NoError(t, err)
-	assert.NotEqual(t, token.Key, resp.Token, "should return a new token")
+	assert.NotEqual(t, token.Plaintext, resp.Token, "should return a new token")
 	assert.Contains(t, resp.Message, "refreshed")
 
 	// Verify old token was deleted
 	var count int64
+	// The DB stores the SHA-256 hash, so query by token.Key (the hash).
 	db.Model(&models.AuthToken{}).Where("key = ?", token.Key).Count(&count)
 	assert.Equal(t, int64(0), count, "old token should be deleted")
 
 	// Verify new token exists in DB
-	db.Model(&models.AuthToken{}).Where("key = ?", resp.Token).Count(&count)
+	// resp.Token is the raw token; the DB stores its hash.
+	db.Model(&models.AuthToken{}).Where("key = ?", models.HashToken(resp.Token)).Count(&count)
 	assert.Equal(t, int64(1), count, "new token should exist in DB")
 
 	// Verify new token belongs to the same user
 	var newToken models.AuthToken
-	require.NoError(t, db.Where("key = ?", resp.Token).First(&newToken).Error)
+	require.NoError(t, db.Where("key = ?", models.HashToken(resp.Token)).First(&newToken).Error)
 	assert.Equal(t, user.ID, newToken.UserID)
 }
 
@@ -115,7 +117,7 @@ func TestRefreshToken_ExpiredToken_Returns401(t *testing.T) {
 
 	svc := newTestAuthService(db)
 
-	resp, err := svc.RefreshToken(context.Background(), token.Key, user.ID)
+	resp, err := svc.RefreshToken(context.Background(), token.Plaintext, user.ID)
 	require.Error(t, err)
 	assert.Nil(t, resp)
 	assert.Contains(t, err.Error(), "error.token_expired")
@@ -130,9 +132,9 @@ func TestRefreshToken_AtExactBoundary60Days(t *testing.T) {
 
 	svc := newTestAuthService(db)
 
-	resp, err := svc.RefreshToken(context.Background(), token.Key, user.ID)
+	resp, err := svc.RefreshToken(context.Background(), token.Plaintext, user.ID)
 	require.NoError(t, err)
-	assert.NotEqual(t, token.Key, resp.Token, "token at 61 days should be refreshed")
+	assert.NotEqual(t, token.Plaintext, resp.Token, "token at 61 days should be refreshed")
 }
 
 func TestRefreshToken_InvalidToken_Returns401(t *testing.T) {
@@ -155,7 +157,7 @@ func TestRefreshToken_WrongUser_Returns401(t *testing.T) {
 	svc := newTestAuthService(db)
 
 	// Try to refresh with a different user ID
-	resp, err := svc.RefreshToken(context.Background(), token.Key, user.ID+999)
+	resp, err := svc.RefreshToken(context.Background(), token.Plaintext, user.ID+999)
 	require.Error(t, err)
 	assert.Nil(t, resp)
 	assert.Contains(t, err.Error(), "error.invalid_token")
@@ -168,7 +170,7 @@ func TestRefreshToken_FreshTokenAt59Days_ReturnsExisting(t *testing.T) {
 
 	svc := newTestAuthService(db)
 
-	resp, err := svc.RefreshToken(context.Background(), token.Key, user.ID)
+	resp, err := svc.RefreshToken(context.Background(), token.Plaintext, user.ID)
 	require.NoError(t, err)
-	assert.Equal(t, token.Key, resp.Token, "token at 59 days should NOT be refreshed")
+	assert.Equal(t, token.Plaintext, resp.Token, "token at 59 days should NOT be refreshed")
 }