fix: harden the sidecar before it faces the internet #6

Fixes the pre-deploy security review's findings.

• Sign-in: /login resolves the owner once and pins the DID through the authorization request. The callback refuses a token for any other account before a session exists, and the store refuses to write a non-owner's session. Pending sign-ins expire after 10 minutes, with at most 32. /login is rate-limited per address and globally. Boot no longer refreshes every owner.
• The server: body, header, request-time, TLS-handshake and concurrency limits. Generic error bodies for anonymous callers, plus security headers.
• Robustness: outbound responses and WebSocket messages are capped. Pagination stops on a page cap or a repeated cursor. Snippets cut on character boundaries. The startup and daily work run as separate guarded tasks with timeouts, and /health now reports refresh and true-up freshness, going stale after 36 hours.
• Scope: accounts and tombstones count only when their DID sits under the listing server's own zones.
• Secrets: session sealing binds the owner DID as associated data, key and session types redact their Debug output, and first-boot key writes are atomic.
• Tooling: cargo deny runs in prek, with the three reviewed advisories ignored with reasons.

cargo test (43, including 9 for the findings), clippy, fmt, prek and the image build pass.

🤖 Generated with Claude Code