fix(security): remediate 2026-05-12 audit findings (Stages 2–5)

Remediation of the 2026-05-12/13 audits (78 findings + cluster gaps),
tracked in deploy-k3s/SECURITY.md, plus fixes from two independent
post-remediation reviews.

Auth & sessions:
- SHA-256 hashed auth-token storage (C1); prior-token cache eviction on
  re-login (MEDIUM-1)
- local Google JWKS verification, iss/aud/exp checks (C2/C3)
- constant-time login + generic errors (L1/LIVE-L11/LIVE-L13)
- per-account login lockout keyed on distinct source IPs (M5/MEDIUM-3)
- verified-email gating, login rate limiting (LIVE-L19, H1-H3)

IAP & webhooks:
- Apple/Google cross-account replay protection (C5/C6/C10/C13, H5/H6)
- migrations 000003-000006 (token hashing, IAP replay, audit_log +
  webhook_event_log table creation, append-only audit log)

Authorization & races:
- file-ownership owner-OR-member fix (C7), atomic share-code join
  (C9/H9), device-token reassignment (C8/LOW-3)

Secrets & deploy:
- secrets file-mounted at /etc/honeydue/secrets, not env (F8); Redis
  password out of the ConfigMap (HIGH-1); B2 keys reconciled
- digest-pinned images, admin ingress hardening, CSP/HSTS, /metrics
  lockdown; kubeconfig 0600, etcd secrets-encryption, fail2ban +
  unattended-upgrades at provision; secret-rotation runbook

Build, vet, and the full test suite (incl. -race) pass; the goose
migration chain is verified against PostgreSQL 16.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

internal/services/iap_validation.go

@@ -68,13 +68,14 @@ type AppleTransactionInfo struct {
 
 // AppleValidationResult contains the result of Apple receipt validation
 type AppleValidationResult struct {
-	Valid            bool
-	TransactionID    string
-	ProductID        string
-	ExpiresAt        time.Time
-	IsTrialPeriod    bool
-	AutoRenewEnabled bool
-	Environment      string
+	Valid                 bool
+	TransactionID         string
+	OriginalTransactionID string // stable across renewals — the replay key
+	ProductID             string
+	ExpiresAt             time.Time
+	IsTrialPeriod         bool
+	AutoRenewEnabled      bool
+	Environment           string
 }
 
 // GoogleValidationResult contains the result of Google token validation
@@ -95,6 +96,21 @@ func NewAppleIAPClient(cfg config.AppleIAPConfig) (*AppleIAPClient, error) {
 		return nil, ErrIAPNotConfigured
 	}
 
+	// Audit H5 (relaxed per MEDIUM-2): refuse to load the IAP signing key from
+	// a world-accessible file — a leaked .p8 lets an attacker forge App Store
+	// Server API requests. The original "0600 or stricter" check is
+	// incompatible with a Kubernetes Secret volume: the kubelet widens secret
+	// files to 0440 once fsGroup is set, so 0600 is unattainable for a
+	// non-root container. Group access is scoped to the pod's fsGroup; the
+	// real exposure is the "other" bits, so reject only those.
+	info, err := os.Stat(cfg.KeyPath)
+	if err != nil {
+		return nil, fmt.Errorf("failed to stat Apple IAP key: %w", err)
+	}
+	if perm := info.Mode().Perm(); perm&0o007 != 0 {
+		return nil, fmt.Errorf("Apple IAP key %s is world-accessible (permissions %#o); remove other-rwx bits", cfg.KeyPath, perm)
+	}
+
 	// Read the private key
 	keyData, err := os.ReadFile(cfg.KeyPath)
 	if err != nil {
@@ -215,11 +231,12 @@ func (c *AppleIAPClient) ValidateTransaction(ctx context.Context, transactionID
 	expiresAt := time.Unix(transactionInfo.ExpiresDate/1000, 0)
 
 	return &AppleValidationResult{
-		Valid:         true,
-		TransactionID: transactionInfo.TransactionID,
-		ProductID:     transactionInfo.ProductID,
-		ExpiresAt:     expiresAt,
-		Environment:   transactionInfo.Environment,
+		Valid:                 true,
+		TransactionID:         transactionInfo.TransactionID,
+		OriginalTransactionID: transactionInfo.OriginalTransactionID,
+		ProductID:             transactionInfo.ProductID,
+		ExpiresAt:             expiresAt,
+		Environment:           transactionInfo.Environment,
 	}, nil
 }
 
@@ -243,11 +260,12 @@ func (c *AppleIAPClient) ValidateReceipt(ctx context.Context, receiptData string
 		if err == nil {
 			expiresAt := time.Unix(transactionInfo.ExpiresDate/1000, 0)
 			return &AppleValidationResult{
-				Valid:         true,
-				TransactionID: transactionInfo.TransactionID,
-				ProductID:     transactionInfo.ProductID,
-				ExpiresAt:     expiresAt,
-				Environment:   transactionInfo.Environment,
+				Valid:                 true,
+				TransactionID:         transactionInfo.TransactionID,
+				OriginalTransactionID: transactionInfo.OriginalTransactionID,
+				ProductID:             transactionInfo.ProductID,
+				ExpiresAt:             expiresAt,
+				Environment:           transactionInfo.Environment,
 			}, nil
 		}
 	}
@@ -317,11 +335,12 @@ func (c *AppleIAPClient) ValidateReceipt(ctx context.Context, receiptData string
 	expiresAt := time.Unix(transactionInfo.ExpiresDate/1000, 0)
 
 	return &AppleValidationResult{
-		Valid:         true,
-		TransactionID: transactionInfo.TransactionID,
-		ProductID:     transactionInfo.ProductID,
-		ExpiresAt:     expiresAt,
-		Environment:   transactionInfo.Environment,
+		Valid:                 true,
+		TransactionID:         transactionInfo.TransactionID,
+		OriginalTransactionID: transactionInfo.OriginalTransactionID,
+		ProductID:             transactionInfo.ProductID,
+		ExpiresAt:             expiresAt,
+		Environment:           transactionInfo.Environment,
 	}, nil
 }
 
@@ -418,13 +437,14 @@ func (c *AppleIAPClient) validateLegacyReceiptWithSandbox(ctx context.Context, r
 	}
 
 	return &AppleValidationResult{
-		Valid:            true,
-		TransactionID:    latestReceipt.TransactionID,
-		ProductID:        latestReceipt.ProductID,
-		ExpiresAt:        expiresAt,
-		IsTrialPeriod:    latestReceipt.IsTrialPeriod == "true",
-		AutoRenewEnabled: autoRenew,
-		Environment:      legacyResponse.Environment,
+		Valid:                 true,
+		TransactionID:         latestReceipt.TransactionID,
+		OriginalTransactionID: latestReceipt.OriginalTransactionID,
+		ProductID:             latestReceipt.ProductID,
+		ExpiresAt:             expiresAt,
+		IsTrialPeriod:         latestReceipt.IsTrialPeriod == "true",
+		AutoRenewEnabled:      autoRenew,
+		Environment:           legacyResponse.Environment,
 	}, nil
 }