Security: pre-launch hardening (Critical/High findings)

[swsOG]

Implements the fixes from the pre-launch security assessment. All changes are server-side; no scan-station UI changes.

What's fixed

ScanStation API (server.py)

• Loopback-only Host guard → blocks DNS-rebinding / off-host access.
• Path-segment sanitisation on every route → blocks the path-traversal that read portal.db (password hashes) and .env (secret key). This breaks the "steal secret → forge admin session" chain.
• Generic error messages (no internal path leakage).

Portal (portal_new/app.py)

• Refuses to boot on a weak/placeholder PORTAL_SECRET_KEY.
• Per-account login lockout + stops trusting X-Forwarded-For → brute force can no longer be bypassed by rotating IPs.
• Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, HSTS (HTTPS).
• Fail-closed tenant scoping (denies when a non-admin's client can't resolve).
• Generic error responses; debug-in-prod guard; wsgi.py for gunicorn.

Deps/CI

• pypdf 6.10.2 + pytest 9.0.3 (CVE fixes). New GitHub Action runs pip-audit + pytest.

Verification

• 76 tests pass (incl. new test_scanstation_security.py / test_portal_security.py).
• Re-ran the live exploit suite against the patched build: the traversal → portal.db/.env theft, the admin-session forgery, and the brute-force bypass are all now blocked. IDOR / CSRF / chat-auth controls still hold. pip-audit: clean.

Notes

• Base is codex/unified-scan-intake (the branch this builds on) for a clean diff — retarget to main if preferred.
• By design (agreed scope), ScanStation still allows same-host local calls without a token; the remote vector is closed by the Host guard. Adding a session token (deferred) would also block local-process access.
• PORTAL_SECRET_KEY rotation + TLS/HSTS termination are deployment-side.

🤖 Generated with Claude Code