Harden auth: setup secret, throttling, session destroy, secure cookies.

Replace username-based admin bootstrap with a one-time setup secret, rate-limit login/register, equalize login bcrypt timing, cap passwords at 72 bytes, destroy sessions on logout, and require Secure cookies when PORT is set.

todo.md

@@ -7,11 +7,12 @@ From the project review. Priority order within each section.
 - [x] **Persist sessions** — Custom sqlc-backed `SessionStore` (scs API kept; no `postgresstore`).
 - [x] **Drop Dockerfile** — DigitalOcean App Platform buildpack from `go.mod`.
 - [x] **Rune-safe truncation** — Form fields truncate by runes.
-- [x] **Admin bootstrap** — `ADMIN_USERNAME` seeds first admin only when none exist; `/admin/users` for promote/demote.
+- [x] **Admin bootstrap** — One-time `ADMIN_SETUP_SECRET` on register (not username alone); `/admin/users` for promote/demote.
 - [x] **Graceful shutdown** — Signal-aware `http.Server.Shutdown` with timeouts.
 - [x] **Handler tests** — Vote HTMX, answer/hide, CSRF, session rotation via in-memory `Store` (no Postgres for web suite).
 - [x] **App Platform listen port** — Prefers `PORT`, then `LISTEN`, then `:8080`.
 - [x] **Prod DB = PlanetScale Postgres** — Required `DATABASE_URL`; DSN cleanup for PlanetScale/libpq-only params.
+- [x] **Auth hardening** — Rate limits, timing-safe login, password ≤72 bytes, logout destroys session, Secure cookies required when `PORT` is set.
 
 ## Docs & ops
 
@@ -20,12 +21,10 @@ From the project review. Priority order within each section.
 
 ## Smaller / later
 
-- [ ] Rate-limit login/register (bcrypt helps; still open to brute-force).
 - [ ] Cursor pagination UI when hunt/profile lists hit their row limits.
 - [ ] Optional Postgres integration tests (`TEST_DATABASE_URL`) for sqlc SessionStore / advisory locks.
 
 ## Suggested order of attack
 
-1. Short README (run, env, admin, App Platform + PlanetScale).
+1. Short README (run, env, admin setup secret, App Platform + PlanetScale).
 2. Migrations plan before the next schema change.
-3. Rate-limit auth endpoints.