Phase 16: hardening and release 0.1.0

- TOTP second factor (RFC 6238, secret encrypted under the master key),
  ten hashed single-use recovery codes, two-step login with a pending token
  bound to the client address, account enrolment/disable, admin reset
- tests/security: prompt-injection corpus never acts or creates evidence-free
  beliefs; roles and CSRF on form and API paths; cross-mind isolation
  (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never
  echoed (API, pages, database, archives); hostile archive import; session
  lifecycle and security headers
- OpenAPI 3.1 document generated from the route table, served at
  /api/v1/openapi.json and kept complete by a test
- gosec clean (justified #nosec annotations, cookie/redirect hardening,
  bounded multipart parsing, UUID packing without narrowing conversions);
  govulncheck clean with toolchain pinned to go1.26.8
- THREAT_MODEL verification pointers, SECURITY.md testing section, README,
  CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status

web/static/app.css

@@ -230,3 +230,4 @@ canvas.graph { width: 100%; height: 560px; display: block; border-radius: 8px; b
 
 /* Study: replay & experiments */
 .replay-step { padding: .6rem 0; border-top: 1px solid var(--border); } .replay-step:first-child { border-top: 0; } .replay-step ul { margin: .2rem 0 0 1rem; padding: 0; } .strong { font-weight: 600; }
+.break { word-break: break-all; }

web/templates/pages/account.html

@@ -25,6 +25,20 @@
       <p class="muted small">Other sessions are signed out when the password changes.</p>
     </form>
   </div>
+  <div class="card" id="totp">
+    <h2>Two-factor authentication</h2>
+    {{if .Data.RecoveryCodes}}<div class="highlight"><p><strong>Recovery codes.</strong> Store these somewhere safe; each works once and they are not shown again.</p><pre class="token"><code>{{range .Data.RecoveryCodes}}{{.}}
+{{end}}</code></pre></div>{{end}}
+    {{if .Data.TOTPEnabled}}<p><span class="badge ok">enabled</span> {{.Data.RecoveryLeft}} recovery code(s) left.</p>
+      <form method="post" action="/account/totp/disable" class="stack"><input type="hidden" name="_csrf" value="{{.CSRF}}"><label>Current password <input type="password" name="current" required autocomplete="current-password"></label><button class="btn btn-danger" data-confirm="Disable two-factor authentication?">Disable</button></form>
+      <form method="post" action="/account/totp/begin" class="stack"><input type="hidden" name="_csrf" value="{{.CSRF}}"><button class="btn">Re-enrol (new secret and codes)</button></form>
+    {{else if .Data.TOTPSecret}}<p>Add this secret to your authenticator app, then confirm with a code.</p>
+      <p class="mono small">Secret: <code>{{.Data.TOTPSecret}}</code></p><p class="small muted break">URI: <code>{{.Data.TOTPURI}}</code></p>
+      <form method="post" action="/account/totp/confirm" class="row"><input type="hidden" name="_csrf" value="{{.CSRF}}"><input name="code" inputmode="numeric" autocomplete="one-time-code" placeholder="123456" required maxlength="6"> <button class="btn btn-primary">Confirm and enable</button></form>
+    {{else if .Data.TOTPAvailable}}<p class="muted small">Off. Enabling it adds a code from an authenticator app to every sign-in and gives you ten single-use recovery codes.</p>
+      <form method="post" action="/account/totp/begin"><input type="hidden" name="_csrf" value="{{.CSRF}}"><button class="btn btn-primary">Enable</button></form>
+    {{else}}<p class="muted small">Unavailable: the server has no <code>NOEMA_MASTER_KEY</code>, so the secret could not be stored encrypted.</p>{{end}}
+  </div>
   <div class="card">
     <h2>API tokens</h2>
     <table class="table compact">

web/templates/pages/login_totp.html

@@ -0,0 +1,14 @@
+{{define "content"}}
+<div class="card auth-card">
+  <div class="brand big"><span class="brand-mark" aria-hidden="true"></span>Noema</div>
+  <p class="muted">Enter the six-digit code from your authenticator app, or one of your recovery codes.</p>
+  <form method="post" action="/login/totp" class="stack">
+    <input type="hidden" name="_csrf" value="{{.CSRF}}">
+    <input type="hidden" name="next" value="{{.Data.Next}}">
+    <label>Code <input name="code" inputmode="numeric" autocomplete="one-time-code" required autofocus maxlength="24"></label>
+    {{with .Data.Error}}<p class="error" role="alert">{{.}}</p>{{end}}
+    <button class="btn btn-primary" type="submit">Continue</button>
+    <p class="muted small"><a href="/login">Start over</a></p>
+  </form>
+</div>
+{{end}}

web/templates/pages/users.html

@@ -18,7 +18,8 @@
         <td>{{if .TOTPEnabled}}<span class="badge ok">TOTP</span>{{else}}<span class="muted">off</span>{{end}}</td>
         <td class="muted small nowrap">{{date .CreatedAt}}</td>
         <td>{{if ne .ID $.Principal.User.ID}}<form method="post" action="/admin/users/{{.ID}}" class="inline"><input type="hidden" name="_csrf" value="{{$.CSRF}}">
-          {{if .Disabled}}<button class="btn small" name="action" value="enable">Enable</button>{{else}}<button class="btn small btn-danger" name="action" value="disable" data-confirm="Disable {{.Username}} and revoke their sessions?">Disable</button>{{end}}</form>{{end}}</td>
+          {{if .Disabled}}<button class="btn small" name="action" value="enable">Enable</button>{{else}}<button class="btn small btn-danger" name="action" value="disable" data-confirm="Disable {{.Username}} and revoke their sessions?">Disable</button>{{end}}
+          {{if .TOTPEnabled}}<button class="btn small" name="action" value="reset-totp" data-confirm="Remove {{.Username}}'s second factor and recovery codes? They should re-enrol.">Reset 2FA</button>{{end}}</form>{{end}}</td>
       </tr>{{end}}</tbody>
     </table>
   </div>