Release v0.27.0: security hardening (audit 0026)

Remediates the rfc-app application + deploy-config findings from the
Session 0026 security audit. Cut as the "v0.25.0-security-hardening"
branch (from v0.24.0); reversioned to 0.27.0 on rebase onto main since
v0.26.0 (#28) shipped while this was in flight.

- C1 (Critical): single sanitizeHtml.js chokepoint (DOMPurify) for every
  marked→innerHTML / dangerouslySetInnerHTML sink (MarkdownPreview,
  ProposalView x2, Editor); rel=noopener hook on target=_blank links.
- H1: per-account OTC-verify lockout (migration 023, auto-applied) +
  per-IP throttle via new ratelimit.py; wired on otc verify/request +
  passcode check/verify.
- M1: device_trust.lookup() single indexed-row read — cookie value is now
  "<row_id>.<raw_token>"; bcrypt-checks one row, not a global table scan.
  (Behavior change: existing device-trust cookies re-prompt once.)
- M2: HTTP security headers (CSP/HSTS/XFO/XCTO/Referrer-Policy) at nginx.
- M4: session cookie Secure-by-default (SESSION_COOKIE_SECURE opt-out).
- M5: bounce webhook fails CLOSED (503) when secret unset, instead of open;
  RFC_APP_INSECURE_BOUNCE_WEBHOOK=1 dev opt-in.
- L2/L3: per-IP cooldown + check-endpoint throttle.
- L4: systemd sandbox knobs. L8/I1: nginx server_tokens off + TLS1.0/1.1 out.

VERSION + frontend/package.json → 0.27.0; CHANGELOG documents the upgrade
steps (incl. the out-of-band nginx + systemd apply, which the flotilla
deploy gesture does not perform).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/app/device_trust.py

@@ -97,6 +97,13 @@ class IssueOutcome:
     raw_token: str
     row_id: int
 
+    @property
+    def cookie_value(self) -> str:
+        """The value to put in the `rfc_device_trust` cookie: the row-id
+        selector joined to the raw token (v0.25.0 / audit 0026 M1). The
+        selector lets `lookup` read one indexed row instead of scanning."""
+        return f"{self.row_id}.{self.raw_token}"
+
 
 def _new_token() -> str:
     return secrets.token_urlsafe(TOKEN_BYTES)
@@ -173,33 +180,37 @@ def lookup(raw_token: str) -> LookupOutcome:
     if not raw:
         return LookupOutcome(ok=False, user=None, reason="invalid")
 
-    # The unique index on `device_token_hash` would let us SELECT by
-    # hash if bcrypt were a stable hash, but bcrypt incorporates a
-    # per-row salt — equal tokens produce different hashes. We walk
-    # the candidate set instead. In practice the set is small (a
-    # human has a handful of trusted devices) and bcrypt is cheap on
-    # the order of milliseconds; the walk is bounded by the user's
-    # active device count.
+    # v0.25.0 (audit 0026 M1): the cookie is "<row_id>.<raw_token>". We
+    # parse the row-id selector and read exactly ONE row by its indexed
+    # primary key, then bcrypt-check the token against that single row.
     #
-    # We don't pre-filter by `revoked_at IS NULL` here so that a
-    # token presented for a recently-revoked row produces a
-    # 'revoked' outcome (the endpoint surfaces a different shape).
-    # Same for expired: we let the walk hit and classify after.
-    rows = db.conn().execute(
+    # The previous shape read EVERY device_trust row (all users, including
+    # revoked/expired) and bcrypt-checked each — an unauthenticated
+    # CPU-amplification DoS reachable at /auth/device-trust/start that
+    # grew without bound as the table accumulated. bcrypt's per-row salt
+    # is why we can't SELECT by hash; carrying the row-id in the cookie is
+    # the standard fix (the id is not secret; the token still is).
+    selector, sep, token = raw.partition(".")
+    if not sep or not selector.isdigit() or not token:
+        # Legacy bare-token cookies (pre-v0.25.0) and malformed values land
+        # here. We refuse rather than fall back to a full-table scan, so
+        # the amplification path is fully closed; affected users simply
+        # re-authenticate once via OTC/passcode and get a new cookie.
+        return LookupOutcome(ok=False, user=None, reason="invalid")
+
+    matched = db.conn().execute(
         """
         SELECT id, user_id, device_token_hash, expires_at, revoked_at
           FROM device_trust
-         ORDER BY id DESC
+         WHERE id = ?
         """,
-    ).fetchall()
+        (int(selector),),
+    ).fetchone()
 
-    matched = None
-    for row in rows:
-        if _check(raw, row["device_token_hash"]):
-            matched = row
-            break
-
-    if matched is None:
+    # One bcrypt check, against the selected row only. A wrong/forged token
+    # for a real id reads as 'unknown' (cookie cleared), same as a missing
+    # row — a probing client can't distinguish the two.
+    if matched is None or not _check(token, matched["device_token_hash"]):
         return LookupOutcome(ok=False, user=None, reason="unknown")
 
     if matched["revoked_at"] is not None: