security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

relay/inc/routes/chat.php

@@ -93,7 +93,7 @@ if ($route === '/api/chat/send' && $method === 'POST' && $sessionTenant) {
     if ($body === '') jsonResponse(['error' => 'body required'], 400);
     if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
     $stored = clientEncrypt($body, $interKey);
@@ -122,7 +122,7 @@ if ($route === '/api/sync-events' && $method === 'POST') {
     if ($recipientName === '') jsonResponse(['error' => 'recipient required'], 400);
     if ($recipientName === $clientTenant['username']) jsonResponse(['ok' => true, 'id' => 0]); // suppress self-notifications
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
     $db->prepare('INSERT INTO relay_sync_events (recipient_id, sender_username, body) VALUES (:r, :sn, :b)')
         ->execute(['r' => $recipient['id'], 'sn' => $clientTenant['username'], 'b' => $body]);
     jsonResponse(['ok' => true, 'id' => (int)$db->lastInsertId()]);
@@ -193,7 +193,8 @@ if ($route === '/api/chat/rooms' && $method === 'POST') {
         $db->commit();
     } catch (Throwable $e) {
         if ($db->inTransaction()) $db->rollBack();
-        jsonResponse(['error' => 'create failed: ' . $e->getMessage()], 500);
+        @error_log('[hyprcrd-relay] chat room create failed: ' . $e->getMessage());
+        jsonResponse(['error' => 'create failed'], 500);
     }
     jsonResponse(['ok' => true, 'uid' => $uid, 'members' => array_values($resolved)]);
 }
@@ -306,7 +307,7 @@ if ($route === '/api/chat' && $method === 'POST') {
             ->execute(['me' => $clientTenant['id'], 's' => $clientTenant['id'], 'sn' => $clientTenant['username'], 'ru' => $roomUid, 'b' => $stored]);
     } else {
         $recipient = getTenantByUsername($db, $recipientName);
-        if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+        if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
         $db->prepare('INSERT INTO chat_messages (recipient_id, sender_id, sender_username, body, persistent) VALUES (:r, :s, :sn, :b, :p)')
             ->execute([
                 'r' => $recipient['id'],
@@ -417,7 +418,7 @@ if ($route === '/api/chat/backfill' && $method === 'GET') {
         $stmt->execute();
     } else {
         $peerTenant = getTenantByUsername($db, $peer);
-        if (!$peerTenant) jsonResponse(['error' => "no such user: $peer"], 404);
+        if (!$peerTenant) jsonResponse(['error' => 'peer not found'], 404);
         $sql = "SELECT id, sender_id, sender_username, room_uid, body, created_at
                 FROM chat_messages
                 WHERE room_uid IS NULL