Security hardening: red-team remediation + CCP/WIP updates

## Security (red-team audit 2026-04-12)

Public data exposure (P0):
- Public map converted to server-side heatmap, 2-decimal (~1.1km) bucketing,
  no addresses/support-levels/sign-info returned
- Petition signers endpoint strips displayName/signerComment/geoCity/geoCountry
- Petition public-stats drops recentSigners entirely
- Response wall strips userComment + submittedByName
- Campaign createdByUserEmail + moderation fields gated to SUPER_ADMIN

Access control (P1):
- Campaign findById/update/delete/email-stats enforce owner === req.user.id
  (SUPER_ADMIN bypasses), return 404 to avoid enumeration
- GPS tracking session route restricted to session owner or SUPER_ADMIN
- Canvass volunteer stats restricted to self or SUPER_ADMIN
- People household endpoints restricted to INFLUENCE + MAP roles (was ADMIN*)
- CCP upgrade.service.ts + certificate.service.ts gate user-controlled
  shell inputs (branch, path, slug, SAN hostname) behind regex validators

Token security (P2):
- Query-param JWT auth replaced with HMAC-signed short-lived URLs
  (utils/signed-url.ts + /api/media/sign endpoint); legacy ?token= removed
  from media streaming, photos, chat-notifications, and social SSE
- GITEA_SSO_SECRET + SERVICE_PASSWORD_SALT now REQUIRED (min 32 chars);
  JWT_ACCESS_SECRET fallback removed — BREAKING for existing deployments
- Refresh tokens bound to device fingerprint (UA + /24 IP) via `df` JWT
  claim; mismatch revokes all user sessions
- Refresh expiry reduced 7d → 24h
- Refresh/logout via request body removed — httpOnly cookie only
- Password-reset + verification-resend rate limits now keyed on (IP, email)
  composite to prevent both IP rotation and email enumeration

Defense-in-depth (P3):
- DOMPurify sanitization applied to GrapesJS landing page HTML/CSS
- /api/health?detailed=true disk-space leak removed
- Password-reset/verification token log lines no longer include userId

## Deployment

- docker-compose.yml + docker-compose.prod.yml: media-api now receives
  GITEA_SSO_SECRET + SERVICE_PASSWORD_SALT; empty fallbacks removed
- CCP templates/env.hbs adds both new secrets; refresh expiry → 24h
- CCP secret-generator.ts generates giteaSsoSecret + servicePasswordSalt
- leaflet.heat added to admin/package.json for heatmap rendering

## Operator action required on existing installs

Run `./config.sh` once (idempotent — only fills empty values) or manually
add GITEA_SSO_SECRET + SERVICE_PASSWORD_SALT to .env via
`openssl rand -hex 32`. Startup fails with a clear Zod error otherwise.

See SECURITY_REDTEAM_2026-04-12.md for full audit and verification matrix.

## Other

Includes in-flight CCP work: instance schema tweaks, agent server updates,
health service, tunnel service, DEV_WORKFLOW doc updates, and new migration
dropping composeProject uniqueness.

Bunker Admin

api/src/config/env.ts

@@ -33,15 +33,21 @@ const envSchema = z.object({
   JWT_REFRESH_SECRET: z.string().min(32),
   JWT_INVITE_SECRET: z.string().min(32),
   JWT_ACCESS_EXPIRY: z.string().default('15m'),
-  JWT_REFRESH_EXPIRY: z.string().default('7d'),
+  // Reduced 2026-04-12 from 7d → 24h. Stolen refresh tokens have a much tighter
+  // exploitation window now; combined with device-fingerprint binding in
+  // auth.service.ts, theft is materially harder to monetize.
+  JWT_REFRESH_EXPIRY: z.string().default('24h'),
 
   // Encryption (for DB-stored secrets like SMTP password — required for all environments)
   ENCRYPTION_KEY: z.string().min(32, 'ENCRYPTION_KEY must be at least 32 characters'),
 
-  // Gitea SSO cookie signing secret — MUST be unique (key separation from JWT)
-  GITEA_SSO_SECRET: z.string().default(''),
-  // Salt for deriving deterministic service passwords (Gitea, Rocket.Chat) — MUST be unique
-  SERVICE_PASSWORD_SALT: z.string().default(''),
+  // Gitea SSO cookie signing secret — MUST be distinct from JWT secrets.
+  // Breaking change 2026-04-12: previously fell back to JWT_ACCESS_SECRET, which
+  // meant a JWT leak compromised SSO cookies too. Now required (min 32 chars).
+  GITEA_SSO_SECRET: z.string().min(32, 'GITEA_SSO_SECRET must be ≥32 chars; generate with: openssl rand -hex 32'),
+  // Salt for deriving deterministic service passwords (Gitea, Rocket.Chat).
+  // Breaking change 2026-04-12: previously fell back to JWT_ACCESS_SECRET. Now required.
+  SERVICE_PASSWORD_SALT: z.string().min(32, 'SERVICE_PASSWORD_SALT must be ≥32 chars; generate with: openssl rand -hex 32'),
 
   // Initial Super Admin (auto-created during database seeding)
   INITIAL_ADMIN_EMAIL: z.string().email().default('admin@cmlite.org'),
@@ -276,16 +282,10 @@ function validateEnv(): Env {
     process.exit(1);
   }
 
-  // Warn about security-critical key separation issues
-  const data = result.data;
-  if (!data.GITEA_SSO_SECRET) {
-    console.warn('⚠ SECURITY WARNING: GITEA_SSO_SECRET is empty — falling back to JWT_ACCESS_SECRET. This violates key separation. Generate a unique secret with: openssl rand -hex 32');
-  }
-  if (!data.SERVICE_PASSWORD_SALT) {
-    console.warn('⚠ SECURITY WARNING: SERVICE_PASSWORD_SALT is empty — falling back to JWT_ACCESS_SECRET. Rotating JWT_ACCESS_SECRET will invalidate all provisioned service passwords. Generate a unique salt with: openssl rand -hex 32');
-  }
-
-  return data;
+  // GITEA_SSO_SECRET and SERVICE_PASSWORD_SALT are now validated as required
+  // via .min(32) above — no more silent JWT_ACCESS_SECRET fallback. If either is
+  // missing, the schema check above exits with a clear error.
+  return result.data;
 }
 
 export const env = validateEnv();