security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

public/plugins/tests/relay.test.js

@@ -3,8 +3,10 @@ import { describe, it, expect, csrf } from './runner.js?v=4';
 describe('Relay: Push API', () => {
     it('push without config returns error', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        // The GET endpoint echoes the secret directly as `key` (single-user local app).
-        if (settings.url && settings.key) return; // skip if configured
+        // GET only reports `has_key` (boolean) — the secret itself is never
+        // echoed. If a relay is configured the real push may succeed or fail
+        // for other reasons, so skip in that case.
+        if (settings.url && settings.has_key) return; // skip if configured
 
         const res = await fetch('api/relay/push', {
             method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
@@ -16,7 +18,7 @@ describe('Relay: Push API', () => {
 
     it('push without card_id returns error', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        if (!settings.url || !settings.key) return; // card_id check is after config check
+        if (!settings.url || !settings.has_key) return; // card_id check is after config check
         const res = await fetch('api/relay/push', {
             method: 'POST', headers: { 'Content-Type': 'application/json', 'X-CSRF-Token': csrf() },
             body: JSON.stringify({}),
@@ -28,7 +30,7 @@ describe('Relay: Push API', () => {
 describe('Relay: Poll API', () => {
     it('poll without config returns 0 pulled', async () => {
         const settings = await fetch('api/relay/settings').then(r => r.json());
-        if (settings.url && settings.key) return;
+        if (settings.url && settings.has_key) return;
 
         const res = await fetch('api/relay/poll', {
             method: 'POST', headers: { 'X-CSRF-Token': csrf() },