fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps),
tracked in deploy-k3s/SECURITY.md, plus fixes from two independent
post-remediation reviews.

Auth & sessions:
- SHA-256 hashed auth-token storage (C1); prior-token cache eviction on
  re-login (MEDIUM-1)
- local Google JWKS verification, iss/aud/exp checks (C2/C3)
- constant-time login + generic errors (L1/LIVE-L11/LIVE-L13)
- per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3)
- verified-email gating, login rate limiting (LIVE-L19, H1-H3)

IAP & webhooks:
- Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6)
- migrations 000003-000006 (token hashing, IAP replay, audit_log +
  webhook_event_log table creation, append-only audit log)

Authorization & races:
- file-ownership owner-OR-member fix (C7), atomic share-code join
  (C9/H9), device-token reassignment (C8/LOW-3)

Secrets & deploy:
- secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis
  password out of the ConfigMap (HIGH-1); B2 keys reconciled
- digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics
  lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban +
  unattended-upgrades at provision; secret-rotation runbook

Build, vet, and the full test suite (incl. -race) pass; the goose
migration chain is verified against PostgreSQL 16.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/services/cache_service.go

@@ -12,6 +12,7 @@ import (
 	"github.com/rs/zerolog/log"
 
 	"github.com/treytartt/honeydue-api/internal/config"
+	"github.com/treytartt/honeydue-api/internal/models"
 )
 
 // CacheService provides Redis caching functionality
@@ -139,22 +140,25 @@ const (
 	TokenCacheTTL   = 5 * time.Minute
 )
 
+// authTokenCacheKey returns the Redis key for an auth token. The raw token
+// is hashed (audit C1) so the plaintext token never appears in a Redis key.
+func authTokenCacheKey(token string) string {
+	return AuthTokenPrefix + models.HashToken(token)
+}
+
 // CacheAuthToken caches a user ID for a token
 func (c *CacheService) CacheAuthToken(ctx context.Context, token string, userID uint) error {
-	key := AuthTokenPrefix + token
-	return c.SetString(ctx, key, fmt.Sprintf("%d", userID), TokenCacheTTL)
+	return c.SetString(ctx, authTokenCacheKey(token), fmt.Sprintf("%d", userID), TokenCacheTTL)
 }
 
 // CacheAuthTokenWithCreated caches a user ID and token creation time for a token
 func (c *CacheService) CacheAuthTokenWithCreated(ctx context.Context, token string, userID uint, createdUnix int64) error {
-	key := AuthTokenPrefix + token
-	return c.SetString(ctx, key, fmt.Sprintf("%d|%d", userID, createdUnix), TokenCacheTTL)
+	return c.SetString(ctx, authTokenCacheKey(token), fmt.Sprintf("%d|%d", userID, createdUnix), TokenCacheTTL)
 }
 
 // GetCachedAuthToken gets a cached user ID for a token
 func (c *CacheService) GetCachedAuthToken(ctx context.Context, token string) (uint, error) {
-	key := AuthTokenPrefix + token
-	val, err := c.GetString(ctx, key)
+	val, err := c.GetString(ctx, authTokenCacheKey(token))
 	if err != nil {
 		return 0, err
 	}
@@ -167,8 +171,7 @@ func (c *CacheService) GetCachedAuthToken(ctx context.Context, token string) (ui
 // GetCachedAuthTokenWithCreated gets a cached user ID and token creation time.
 // Returns userID, createdUnix, error. createdUnix is 0 if not stored (legacy format).
 func (c *CacheService) GetCachedAuthTokenWithCreated(ctx context.Context, token string) (uint, int64, error) {
-	key := AuthTokenPrefix + token
-	val, err := c.GetString(ctx, key)
+	val, err := c.GetString(ctx, authTokenCacheKey(token))
 	if err != nil {
 		return 0, 0, err
 	}
@@ -184,8 +187,62 @@ func (c *CacheService) GetCachedAuthTokenWithCreated(ctx context.Context, token
 
 // InvalidateAuthToken removes a cached token
 func (c *CacheService) InvalidateAuthToken(ctx context.Context, token string) error {
-	key := AuthTokenPrefix + token
-	return c.Delete(ctx, key)
+	return c.Delete(ctx, authTokenCacheKey(token))
+}
+
+// InvalidateAuthTokenHashes removes cached entries for already-hashed token
+// keys. Unlike InvalidateAuthToken (which hashes a plaintext), this takes the
+// stored hash directly — used to evict a user's prior token on re-login
+// (audit MEDIUM-1), where the server no longer has the plaintext.
+func (c *CacheService) InvalidateAuthTokenHashes(ctx context.Context, hashes ...string) error {
+	keys := make([]string, 0, len(hashes))
+	for _, h := range hashes {
+		if h != "" {
+			keys = append(keys, AuthTokenPrefix+h)
+		}
+	}
+	if len(keys) == 0 {
+		return nil
+	}
+	return c.Delete(ctx, keys...)
+}
+
+// --- Per-account login-failure tracking (audit M5) ---
+
+const loginFailPrefix = "login_fail:"
+
+// RegisterLoginFailure records a failed login for an account from a given
+// source IP, and returns the number of DISTINCT source IPs that have failed
+// for this account within the window. Tracking distinct IPs as a set rather
+// than a raw counter (audit MEDIUM-3) means one attacker, from one IP, cannot
+// run the count up and lock a victim out by knowing only their email — a
+// single IP is bounded by the per-IP edge/app rate limiters instead. A
+// genuinely distributed credential-stuffing attack still trips the lockout.
+func (c *CacheService) RegisterLoginFailure(ctx context.Context, identifier, ip string, window time.Duration) (int64, error) {
+	key := loginFailPrefix + identifier
+	member := ip
+	if member == "" {
+		member = "unknown"
+	}
+	if err := c.client.SAdd(ctx, key, member).Err(); err != nil {
+		return 0, err
+	}
+	// Refresh the TTL on each failure: an active attack keeps the window
+	// open, while a quiet account ages out `window` after its last failure.
+	_ = c.client.Expire(ctx, key, window).Err()
+	return c.client.SCard(ctx, key).Result()
+}
+
+// LoginFailureIPCount returns how many distinct source IPs have failed to log
+// in to this account within the window (audit MEDIUM-3). SCard on a missing
+// key returns 0.
+func (c *CacheService) LoginFailureIPCount(ctx context.Context, identifier string) (int64, error) {
+	return c.client.SCard(ctx, loginFailPrefix+identifier).Result()
+}
+
+// ClearLoginFailures resets the failed-login IP set after a successful login.
+func (c *CacheService) ClearLoginFailures(ctx context.Context, identifier string) error {
+	return c.client.Del(ctx, loginFailPrefix+identifier).Err()
 }
 
 // Static data cache helpers