Phase 4: endpoint and secret security

[XonkelX]

Summary

Completes Phase 4 endpoint and secret security.

• Enforces strict public-HTTPS endpoint URL policy
• Adds signed challenge-response endpoint verification and re-verification after URL changes
• Encrypts endpoint-specific signing secrets with AES-GCM
• Adds bounded secret rotation with dual-signature grace
• Prevents delivery to pending, paused, and disabled endpoints
• Hardens owner sessions with signed cookies, CSRF protection, short TTLs, and logout
• Adds fail-closed per-key and global daily ingestion quotas
• Adds restrictive browser-origin policy, CSP, security headers, and safe error responses
• Updates the threat model and Phase 4 documentation

Validation

• format-check
• lint
• typecheck
• unit/integration tests
• Playwright E2E
• build
• cost guardrails
• production dependency audit
• Phase 4 security regression suite
• secret scan