security: harden auth — error disclosure, token blacklisting, rate limiting, timing

[menottim]

Summary

5 security fixes for the authentication subsystem:

1. Error info disclosure (Critical) — Remove str(e) from 7 HTTPException detail fields in instances.py and search_queue.py. Internal error details (table names, connection strings) were being returned to clients.
2. Validation error handler crash (Medium) — Fix TypeError: Object of type bytes is not JSON serializable when form-urlencoded input hits JSON endpoints. Now decodes bytes to strings.
3. Access token not blacklisted on password change (High) — After password change, the current access token remained valid for up to 15 min. Now calls blacklist_access_token().
4. disable_2fa missing rate limit and lockout (High) — Added @limiter.limit("3/minute") and increment_failed_login() on password failure.
5. Timing side-channel on locked accounts (Medium) — Locked accounts returned in ~1ms vs ~2000ms for invalid passwords, enabling enumeration. Added dummy Argon2 hash to equalize timing.

Severity: Critical + High + Medium

Test plan

• Verify error responses no longer contain internal exception text
• Submit form-urlencoded data to a JSON endpoint — should get clean 422, not 500
• After password change, verify old access token is rejected
• Verify disable_2fa rate limiting works (4th attempt within 1 min should be blocked)
• Verify locked account login timing matches invalid-password timing

Ref: docs/security-assessment-2026-02-27.md findings CRIT-3, HIGH-4, HIGH-7, MED-3, MED-5

🤖 Generated with Claude Code