Phase 16: hardening and release 0.1.0

- TOTP second factor (RFC 6238, secret encrypted under the master key),
  ten hashed single-use recovery codes, two-step login with a pending token
  bound to the client address, account enrolment/disable, admin reset
- tests/security: prompt-injection corpus never acts or creates evidence-free
  beliefs; roles and CSRF on form and API paths; cross-mind isolation
  (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never
  echoed (API, pages, database, archives); hostile archive import; session
  lifecycle and security headers
- OpenAPI 3.1 document generated from the route table, served at
  /api/v1/openapi.json and kept complete by a test
- gosec clean (justified #nosec annotations, cookie/redirect hardening,
  bounded multipart parsing, UUID packing without narrowing conversions);
  govulncheck clean with toolchain pinned to go1.26.8
- THREAT_MODEL verification pointers, SECURITY.md testing section, README,
  CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status

internal/auth/store.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/jackc/pgx/v5/pgxpool"
 
+	"github.com/andydixon/noema/internal/security/secrets"
 	"github.com/andydixon/noema/internal/storage"
 	"github.com/andydixon/noema/pkg/ids"
 )
@@ -60,6 +61,8 @@ type Service struct {
 	absoluteTTL time.Duration
 	limiter     *ipLimiter
 	now         func() time.Time
+	secrets     *secrets.Resolver
+	pending     pendingStore
 }
 
 // NewService creates the authentication service.
@@ -68,7 +71,7 @@ func NewService(db *pgxpool.Pool, idleTTL, absoluteTTL time.Duration) *Service {
 }
 
 // SweepLimiter releases idle rate-limit buckets; call periodically.
-func (s *Service) SweepLimiter() { s.limiter.Sweep() }
+func (s *Service) SweepLimiter() { s.limiter.Sweep(); s.pending.sweep(s.now()) }
 
 // CreateUser adds an account. Usernames are unique case-insensitively.
 func (s *Service) CreateUser(ctx context.Context, username, password string, role Role) (User, error) {
@@ -215,6 +218,12 @@ func (s *Service) Login(ctx context.Context, username, password, ip, userAgent s
 	if _, err := s.db.Exec(ctx, `UPDATE users SET failed_attempts=0, locked_until=NULL WHERE id=$1`, u.ID); err != nil {
 		return Session{}, "", err
 	}
+	if u.TOTPEnabled {
+		// Password accepted; hand back a pending token instead of a session.
+		token, hash := newToken()
+		s.pending.put(string(hash), &pending{userID: u.ID, ip: clientKey(ip), ua: truncate(userAgent, 256), expires: s.now().Add(pendingTTL)})
+		return Session{}, token, ErrSecondFactorRequired
+	}
 	return s.createSession(ctx, u.ID, ip, userAgent)
 }