Harden product security boundaries

[fjbarrett]

Summary

• isolate offline account data and revoke all sessions on explicit sign-out
• bound request bodies, authenticate and rate-limit AI metadata, cap account storage, and strengthen password hashing
• replace public attachment writes with private owner/share-authorized delivery and validated raster uploads
• verify Postgres TLS, add HSTS and stricter browser policy, and require longer vanity share tokens
• pin CI actions and SSH host verification; sandbox and harden the Mac client while removing note bodies from Spotlight

Verification

• npx tsc --noEmit
• npm test (148 tests)
• npm run build
• npm audit --audit-level=high (0 vulnerabilities)
• xcodegen generate and unsigned KeepMac x86_64 build
• staged and repository-history gitleaks scans
• Semgrep auto scan found no application findings

No screenshot was added because the rendered controls and layout are unchanged.

Rollout notes

• production must set the exact HTTPS AUTH_URL
• private/self-signed Postgres CAs must be supplied through DATABASE_CA_CERT; insecure TLS now requires an explicit loopback-only opt-in
• set a separately verified DEPLOY_KNOWN_HOSTS secret before merge or the deploy job will skip
• AI metadata is now off unless AI_METADATA_ENABLED=true is set
• old provider-hosted public attachments need the inventory/migration described in SECURITY.md

[fjbarrett]

A multi-agent code review of this branch confirmed 10 issues — two deploy-breaking (the middleware CSRF check compared Origin against the internal listen origin; the DB TLS default flip rejected the droplet's self-signed Postgres), one defeating revocation for all pre-deploy JWTs, plus data-loss and behavior regressions (byte-vs-char note cap, CSP breaking legacy images, offline-op loss on sign-out and legacy-DB discard, sign-out revoking all devices, AI metadata silently off, upload-quota leak).

All ten are fixed in e8b08f1, with tests updated/added (151 passing) and the CSRF fix verified against next start using production-shaped requests.

Known follow-up: the iOS client's sign-out still POSTs /api/auth/revoke, so native sign-out remains "sign out everywhere" until that call is removed.