fix(kap-server): cache successful password verification

[shizhigu]

Related Issue

Resolve #1904

Problem

Each password-authenticated REST or WebSocket request ran cost-12 bcrypt again. This made Kimi Web startup and refresh slow on low-power hosts.

What changed

flowchart LR
  A[Bearer credential] --> B{RPC token?}
  B -->|yes| F[Accept]
  B -->|no| C{Persistent token?}
  C -->|yes| F
  C -->|no| D{Recent password HMAC?}
  D -->|yes| F
  D -->|no| E[bcrypt.compare]
  E -->|valid| F
  E -->|invalid| G[Reject]

Loading

The verifier keeps one successful candidate for five minutes as a process-local, keyed HMAC. It stores neither plaintext nor an unkeyed digest. Cache hits do not extend expiry, failures are not cached, and overlapping checks of the same candidate share one bcrypt comparison. Both token paths bypass bcrypt.

Validation

• Focused auth, RPC, and WebSocket tests: 78 passed. Full kap-server suite: 722 passed.
• Typecheck, type-aware lint, CLI production build, bundle smoke, and git diff --check passed.
• A real server smoke covered persistent and RPC tokens, first and cached password REST, password WebSocket auth, and rejected credentials. It observed 223 ms for the first password check and 2 ms for the cache hit; this is not a benchmark.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

[changeset-bot]

🦋 Changeset detected

Latest commit: 76c518b

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[shizhigu]

@codex review

@sailist Ready for review when you have a moment. The change is scoped to successful password verification caching, with focused concurrency and authentication coverage.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 76c518b176

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".