security: v2.0 — AES-GCM crypto, SSRF guards, rate limits, hardening

Breaking wire-format change: dual-read (V1+V2) / single-write (V2) so
existing user secrets, stored messages, and inter-tenant key keep
working. Old clients and relays lose cross-version chat until both
sides are upgraded.

Relay
- Switch clientEncrypt/masterEncrypt to AES-256-GCM with HKDF-derived
  per-ciphertext salts; keep CBC-V1 fallback on decrypt only.
- On-bootstrap migration re-envelopes tenant secret_encrypted and the
  inter-tenant key to GCM-V2 (idempotent).
- CORS: stop reflecting arbitrary Origin; allow own origin + optional
  RELAY_CORS_ORIGINS env allowlist; drop Access-Control-Allow-Credentials.
- Generic error messages replace "no such user: <name>" enumeration.
- Exception messages no longer echoed back; logged server-side.
- Collab-lock max hold capped at 10min so a member can't grief-refresh
  forever.
- Attachment filenames validated against hex.<ext> pattern.
- Passwords min length 10; /api/account/password rate-limited.

App / Electron client
- Shared hyprcrdRelayEncrypt/Decrypt helpers (GCM-V2 write, V1 read).
- Chat + collab-buckets plugins delegate to the shared helpers.
- Poll + push + attachments migrated to the dual-format path.
- /api/relay/settings GET returns has_key boolean; secret never echoed.
- Setup endpoint now CSRF-checked.
- SSRF: CURLOPT_PROTOCOLS restricted to HTTP(S) everywhere; bookmarks
  favicon fetch also blocks private/loopback/link-local.
- Login / password-change rate limiter moved to DB-backed IP keying.
- Passwords min length 10 throughout.
- Zip import enforces per-file (25MB) and total (500MB) caps, extension
  allowlist, no-overwrite.
- Verbose relay-push debug gated behind APP_DEBUG env.

Version bumped to 2.0.0 (protocol-breaking).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

relay/inc/routes/messages.php

@@ -21,7 +21,7 @@ if ($route === '/api/messages' && $method === 'POST' && $sessionTenant && empty(
     if ($body === '') jsonResponse(['error' => 'body required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -54,7 +54,7 @@ if ($route === '/api/attachments/upload' && $method === 'POST' && $sessionTenant
     if (!$relayUid) jsonResponse(['error' => 'relay_uid required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     $interKey = getInterTenantKey($db, $MASTER_KEY);
     if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
@@ -142,7 +142,7 @@ if ($route === '/api/messages' && $method === 'POST') {
     if ($encryptedBody === '') jsonResponse(['error' => 'body required'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     // Decrypt with sender's secret
     if (empty($clientTenant['secret_encrypted'])) {
@@ -225,9 +225,12 @@ if ($route === '/api/attachments' && $method === 'POST') {
     $data = (string)($input['data'] ?? '');
     $recipientName = trim((string)($input['recipient'] ?? $clientTenant['username']));
     if (!$relayUid || !$filename || !$data) jsonResponse(['error' => 'relay_uid, filename, and data required'], 400);
+    // Enforce the hyprcrd upload naming scheme server-side so traversal-shaped
+    // names never enter storage or get forwarded back to other clients.
+    if (!preg_match('/^[a-f0-9]{8,64}\.[a-z0-9]{1,8}$/', $filename)) jsonResponse(['error' => 'invalid filename'], 400);
 
     $recipient = getTenantByUsername($db, $recipientName);
-    if (!$recipient) jsonResponse(['error' => "no such user: $recipientName"], 404);
+    if (!$recipient) jsonResponse(['error' => 'recipient not found'], 404);
 
     // Decrypt-reencrypt hop, same shape as messages: arrives encrypted with
     // sender's secret, gets stored at-rest under the inter-tenant key.