feat: improved security hardening

[r0ssing]

Security hardening

Description

Added bounded authentication throttling for login and refresh endpoints:

• per-source request limits;
• per-source-and-username failed-login limits;
• account-wide failed-login limits;
• bounded limiter cardinality and authentication request sizes;
• 429 Too Many Requests with Retry-After;
• trusted-proxy-aware client address handling that does not accept spoofed forwarding headers.
• Reduced authentication enumeration and resource-exhaustion risks through dummy bcrypt work, bounded fields, strict JSON parsing, and stable public errors.
• Added signed access/refresh token-purpose claims while preserving compatibility with legacy untyped JWTs during migration.
• Restricted JWT validation to HS256, required expiration, and enforced issuer validation for newly typed tokens.
• Retained stateless JWT validation. Existing tokens cannot be immediately revoked after password changes, account deletion, role changes, or sign-out; this limitation and emergency global key rotation are documented.
• Hardened attachment uploads while raising the configurable default content limit to 128 MiB:
  • authenticated write-role enforcement;
  • request and content bounds;
  • streaming non-image uploads;
  • bounded image dimensions, pixels, and processing concurrency;
  • strict attachment identifiers and filesystem containment;
  • atomic no-replace storage and manifest rollback;
  • safe response headers.
• Added complete Formulus sign-out and invalid-credential handling:
  • confirmed invalid credentials clear the existing local session and rejected saved credentials;
  • throttling, network errors, version mismatches, and server failures preserve valid sessions;
  • credentials are stored only after successful authentication.
• Updated Portal, CLI, and Desktop to distinguish throttling and transient refresh failures from invalid sessions.
• Hardened CLI configuration storage with restrictive permissions and secret redaction.
• Documented all authentication security settings, trusted-proxy configuration, legacy-token rollout procedure, stateless revocation limitations, and per-process limiter behavior.
• Added 413 and 429 authentication responses to the OpenAPI contract.
• Investigated CORS without changing enforcement: native clients are unaffected by browser CORS, the embedded Portal is generally same-origin, and browser/Tauri/custom-protocol origins require deployment inventory before safely restricting origins.

Type of Change

• Bug Fix
• New Feature / Enhancement
• Refactor / Code Cleanup
• Documentation Update
• Maintenance / Chore
• Other (please specify):

---

Component(s) Affected

• formulus (React Native mobile app)
• formulus-formplayer (React web app)
• synkronus (Go backend server)
• synkronus-cli (Command-line utility)
• Documentation
• DevOps / CI/CD
• Desktop

---

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manually tested
• Tested on multiple platforms (if applicable)
• Not applicable

---

Breaking Changes

• This PR introduces breaking changes
• This PR does NOT introduce breaking changes

If breaking changes, please describe migration steps:

---

Documentation Updates

• Documentation has been updated
• Documentation update is not required

---

Checklist

• Code follows project style guidelines
• All existing tests pass
• New tests added for new functionality
• PR title follows Conventional Commits format

---

Thank you for contributing to Open Data Ensemble (ODE)!

[Ndacyayisenga-droid]

LGTM