security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

relay/inc/bootstrap.php

@@ -395,6 +395,34 @@ $db->exec('CREATE TABLE IF NOT EXISTS rate_limits (
     attempted_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP
 )');
 
+// ── v3.x → v1.10 crypto migration ────────────────────────────────
+// Re-encrypt master-wrapped secrets (tenant client secrets + inter-tenant
+// key) from CBC-V1 to GCM-V2. This only touches data we already hold the
+// master key for, so no user action is needed and no secrets change —
+// only the envelope around them. Idempotent: rows already in V2 skip.
+require_once __DIR__ . '/crypto.php';
+if (tableExists($db, 'tenants')) {
+    $legacyTenantRows = $db->query("SELECT id, secret_encrypted FROM tenants WHERE secret_encrypted IS NOT NULL AND secret_encrypted != '' AND secret_encrypted NOT LIKE '" . HYPRCRD_GCM_MAGIC_MASTER . "%'")->fetchAll();
+    if ($legacyTenantRows) {
+        $upd = $db->prepare('UPDATE tenants SET secret_encrypted = :s WHERE id = :i');
+        foreach ($legacyTenantRows as $r) {
+            $plain = masterDecrypt($r['secret_encrypted'], $MASTER_KEY);
+            if ($plain !== '') {
+                $upd->execute(['s' => masterEncrypt($plain, $MASTER_KEY), 'i' => $r['id']]);
+            }
+        }
+        @error_log('[hyprcrd-relay] migrated ' . count($legacyTenantRows) . ' tenant secret_encrypted rows to GCM-V2');
+    }
+    $legacyItk = $db->query("SELECT value FROM settings WHERE key = 'inter_tenant_key'")->fetchColumn();
+    if ($legacyItk && !str_starts_with($legacyItk, HYPRCRD_GCM_MAGIC_MASTER)) {
+        $plainItk = masterDecrypt($legacyItk, $MASTER_KEY);
+        if ($plainItk !== '') {
+            setInterTenantKey($db, $MASTER_KEY, $plainItk);
+            @error_log('[hyprcrd-relay] migrated inter-tenant key to GCM-V2');
+        }
+    }
+}
+
 // Cleanup: 24h ephemeral storage, expired sessions, old rate limits
 $db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')");
 $db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')");