fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps),
tracked in deploy-k3s/SECURITY.md, plus fixes from two independent
post-remediation reviews.

Auth & sessions:
- SHA-256 hashed auth-token storage (C1); prior-token cache eviction on
  re-login (MEDIUM-1)
- local Google JWKS verification, iss/aud/exp checks (C2/C3)
- constant-time login + generic errors (L1/LIVE-L11/LIVE-L13)
- per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3)
- verified-email gating, login rate limiting (LIVE-L19, H1-H3)

IAP & webhooks:
- Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6)
- migrations 000003-000006 (token hashing, IAP replay, audit_log +
  webhook_event_log table creation, append-only audit log)

Authorization & races:
- file-ownership owner-OR-member fix (C7), atomic share-code join
  (C9/H9), device-token reassignment (C8/LOW-3)

Secrets & deploy:
- secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis
  password out of the ConfigMap (HIGH-1); B2 keys reconciled
- digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics
  lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban +
  unattended-upgrades at provision; secret-rotation runbook

Build, vet, and the full test suite (incl. -race) pass; the goose
migration chain is verified against PostgreSQL 16.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/services/auth_service_test.go

@@ -54,7 +54,7 @@ func TestAuthService_Login(t *testing.T) {
 		Password: "Password123",
 	}
 
-	resp, err := service.Login(context.Background(), req)
+	resp, err := service.Login(context.Background(), req, "")
 	require.NoError(t, err)
 	assert.NotEmpty(t, resp.Token)
 	assert.Equal(t, "testuser", resp.User.Username)
@@ -75,7 +75,7 @@ func TestAuthService_Login_ByEmail(t *testing.T) {
 		Password: "Password123",
 	}
 
-	resp, err := service.Login(context.Background(), req)
+	resp, err := service.Login(context.Background(), req, "")
 	require.NoError(t, err)
 	assert.NotEmpty(t, resp.Token)
 }
@@ -95,7 +95,7 @@ func TestAuthService_Login_InvalidCredentials(t *testing.T) {
 		Password: "WrongPassword1",
 	}
 
-	_, err := service.Login(context.Background(), req)
+	_, err := service.Login(context.Background(), req, "")
 	testutil.AssertAppError(t, err, http.StatusUnauthorized, "error.invalid_credentials")
 }
 
@@ -112,7 +112,7 @@ func TestAuthService_Login_UserNotFound(t *testing.T) {
 		Password: "Password123",
 	}
 
-	_, err := service.Login(context.Background(), req)
+	_, err := service.Login(context.Background(), req, "")
 	testutil.AssertAppError(t, err, http.StatusUnauthorized, "error.invalid_credentials")
 }
 
@@ -134,8 +134,10 @@ func TestAuthService_Login_InactiveUser(t *testing.T) {
 		Password: "Password123",
 	}
 
-	_, err := service.Login(context.Background(), req)
-	testutil.AssertAppError(t, err, http.StatusUnauthorized, "error.account_inactive")
+	_, err := service.Login(context.Background(), req, "")
+	// Audit L1: inactive accounts return the same generic error as bad
+	// credentials so login does not disclose which accounts exist.
+	testutil.AssertAppError(t, err, http.StatusUnauthorized, "error.invalid_credentials")
 }
 
 // === Register ===
@@ -443,7 +445,7 @@ func TestAuthService_ResetPassword(t *testing.T) {
 		Username: "testuser",
 		Password: "NewPassword123",
 	}
-	loginResp, err := service.Login(context.Background(), loginReq)
+	loginResp, err := service.Login(context.Background(), loginReq, "")
 	require.NoError(t, err)
 	assert.NotEmpty(t, loginResp.Token)
 }
@@ -472,7 +474,7 @@ func TestAuthService_Logout(t *testing.T) {
 		Username: "testuser",
 		Password: "Password123",
 	}
-	loginResp, err := service.Login(context.Background(), loginReq)
+	loginResp, err := service.Login(context.Background(), loginReq, "")
 	require.NoError(t, err)
 
 	// Logout
@@ -659,7 +661,7 @@ func TestAuthService_Login_EmptyPassword(t *testing.T) {
 		Password: "",
 	}
 
-	_, err := service.Login(context.Background(), req)
+	_, err := service.Login(context.Background(), req, "")
 	testutil.AssertAppError(t, err, http.StatusUnauthorized, "error.invalid_credentials")
 }