Phase 16: hardening and release 0.1.0

- TOTP second factor (RFC 6238, secret encrypted under the master key),
  ten hashed single-use recovery codes, two-step login with a pending token
  bound to the client address, account enrolment/disable, admin reset
- tests/security: prompt-injection corpus never acts or creates evidence-free
  beliefs; roles and CSRF on form and API paths; cross-mind isolation
  (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never
  echoed (API, pages, database, archives); hostile archive import; session
  lifecycle and security headers
- OpenAPI 3.1 document generated from the route table, served at
  /api/v1/openapi.json and kept complete by a test
- gosec clean (justified #nosec annotations, cookie/redirect hardening,
  bounded multipart parsing, UUID packing without narrowing conversions);
  govulncheck clean with toolchain pinned to go1.26.8
- THREAT_MODEL verification pointers, SECURITY.md testing section, README,
  CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status

pkg/ids/ids.go

@@ -7,6 +7,7 @@ package ids
 
 import (
 	"crypto/rand"
+	"encoding/binary"
 	"encoding/hex"
 	"errors"
 	"sync"
@@ -51,14 +52,14 @@ func New() ID {
 	seq := lastSeq
 	mu.Unlock()
 
-	b[0] = byte(ms >> 40)
-	b[1] = byte(ms >> 32)
-	b[2] = byte(ms >> 24)
-	b[3] = byte(ms >> 16)
-	b[4] = byte(ms >> 8)
-	b[5] = byte(ms)
-	b[6] = 0x70 | byte(seq>>8)  // version 7 + high 4 bits of counter
-	b[7] = byte(seq)            // low 8 bits of counter
+	b[0] = byte(ms >> 40) // #nosec G115 -- deliberate byte packing of a 48-bit millisecond timestamp
+	b[1] = byte(ms >> 32) // #nosec G115 -- deliberate byte packing (UUIDv7 layout)
+	b[2] = byte(ms >> 24) // #nosec G115 -- deliberate byte packing (UUIDv7 layout)
+	b[3] = byte(ms >> 16) // #nosec G115 -- deliberate byte packing (UUIDv7 layout)
+	b[4] = byte(ms >> 8)  // #nosec G115 -- deliberate byte packing (UUIDv7 layout)
+	b[5] = byte(ms)       // #nosec G115 -- deliberate byte packing (UUIDv7 layout)
+	// Version 7 in the high nibble of byte 6, then the 12-bit counter.
+	binary.BigEndian.PutUint16(b[6:8], 0x7000|(seq&0x0fff))
 	b[8] = 0x80 | (b[8] & 0x3f) // RFC 4122 variant
 	return ID(format(b))
 }