Harden upload validation, token storage, auth revocation, and comment ownership

[zerox80]

Summary

Nine security hardening fixes, ordered by severity. Each is an isolated commit.

• Upload validation logic bug (HIGH): the magic-byte check only rejected a file when the detected content type was itself in the allowlist and differed from the claimed extension. A detected type outside the allowlist (exe, zip, pdf, ...) never triggered rejection, so it was saved under whatever extension the client claimed. Inverted the condition to reject unconditionally on any non-allowlisted detected type.
• Token blacklist stored JWTs in plaintext (MEDIUM-HIGH): anyone reading the SQLite file would gain directly reusable session tokens valid for up to 24h. Now hashed with SHA-256 before storage/comparison.
• Fail-open blacklist check in auth_middleware (MEDIUM-HIGH): a database error during the revocation check was silently treated as "not revoked", the only defense against revoked tokens on admin routes. Now fails closed (500) like the Claims extractor already does.
• Comment ownership via spoofable display name (MEDIUM): delete_comment compared comment.author == claims.sub, but author is a free-text name guests can set almost arbitrarily. A registered user could delete a guest's comment if the guest happened to type that user's username. Added author_username/is_guest columns to record real identity; pre-migration rows retain the old check as a documented, time-bounded residual risk.
• Vote endpoint had no rate limit (MEDIUM): /api/comments/{id}/vote was outside the GovernorLayer that protects the other public comment routes. Grouped under the same layer.
• HSTS spoofable via x-forwarded-proto (LOW): when TRUST_PROXY_IP_HEADERS=true, that header isn't stripped, so a client with direct backend access could set it. Removed the auto-detection; HSTS now requires the existing explicit ENABLE_HSTS opt-in.
• Docker build on floating nightly tag (LOW): no nightly-only features are used (MSRV 1.82). Pinned to rust:1.83-bookworm.
• bcrypt silently truncates at 72 bytes (LOW): added a warning log when ADMIN_PASSWORD exceeds 72 bytes rather than changing the validation cap, which risked locking out existing admins with longer passwords.
• Unused rehype-raw dependency (LOW): not imported anywhere; left in place it's a stored-XSS landmine if ever wired into the markdown pipeline without sanitization.

Deliberately out of scope (documented, not coded): CSP style-src 'unsafe-inline' (20+ inline-style call sites, needs a larger frontend refactor with no active exploit path); JWT refresh/rotation (a feature, not a bug); comment content stored unescaped (safe today since only React renders it, a future concern only for non-React consumers).

Test plan

• cargo build and cargo test — all 31 unit tests + all integration test files pass, including new tests for the blacklist hashing round-trip, the fail-closed middleware regression, and 5 new comment-ownership authorization cases (including the critical spoofed-guest-identity regression test)
• cargo clippy --all-targets — no warnings
• cargo fmt --check — clean
• npm run build — frontend builds successfully after rehype-raw removal
• docker build -f backend/Dockerfile backend/ — not verified in this environment (no Docker available); recommend confirming before merge

🤖 Generated with Claude Code

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}