fix: harden auth, cron secrets, and provider flows (GNU-17) (#148)

- Replace === with crypto.timingSafeEqual in all 7 cron routes via shared lib/auth/cron.ts
- Add in-memory rate limiting (60 req/min) and expires_at support to calendar feed
- Add exponential backoff on MFA verify after 3 failed attempts
- Add 60s cooldown on password reset requests
- Validate bank callback auth code format before API call
- Redact session IDs from bank sync and callback logs
- Validate OAuth redirect_uris against allowlist (claude.ai, claude.com, localhost)
- Remove excessive PII/debug console logging from login page

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/auth/__tests__/cron.test.ts

@@ -0,0 +1,64 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { verifyCronSecret } from '../cron'
+
+describe('verifyCronSecret', () => {
+  beforeEach(() => {
+    vi.unstubAllEnvs()
+  })
+
+  it('returns 401 when CRON_SECRET is not set', () => {
+    vi.stubEnv('CRON_SECRET', '')
+    const request = new Request('http://localhost/api/cron', {
+      headers: { authorization: 'Bearer test-secret' },
+    })
+    const result = verifyCronSecret(request)
+    expect(result).not.toBeNull()
+    expect(result!.status).toBe(401)
+  })
+
+  it('returns 401 when no authorization header is provided', () => {
+    vi.stubEnv('CRON_SECRET', 'test-secret')
+    const request = new Request('http://localhost/api/cron')
+    const result = verifyCronSecret(request)
+    expect(result).not.toBeNull()
+    expect(result!.status).toBe(401)
+  })
+
+  it('returns 401 when token does not match', () => {
+    vi.stubEnv('CRON_SECRET', 'correct-secret')
+    const request = new Request('http://localhost/api/cron', {
+      headers: { authorization: 'Bearer wrong-secret' },
+    })
+    const result = verifyCronSecret(request)
+    expect(result).not.toBeNull()
+    expect(result!.status).toBe(401)
+  })
+
+  it('returns null (authorized) when Bearer token matches', () => {
+    vi.stubEnv('CRON_SECRET', 'correct-secret')
+    const request = new Request('http://localhost/api/cron', {
+      headers: { authorization: 'Bearer correct-secret' },
+    })
+    const result = verifyCronSecret(request)
+    expect(result).toBeNull()
+  })
+
+  it('returns null (authorized) when bare token matches', () => {
+    vi.stubEnv('CRON_SECRET', 'correct-secret')
+    const request = new Request('http://localhost/api/cron', {
+      headers: { authorization: 'correct-secret' },
+    })
+    const result = verifyCronSecret(request)
+    expect(result).toBeNull()
+  })
+
+  it('handles tokens of different lengths safely', () => {
+    vi.stubEnv('CRON_SECRET', 'short')
+    const request = new Request('http://localhost/api/cron', {
+      headers: { authorization: 'Bearer a-much-longer-token-that-differs-in-length' },
+    })
+    const result = verifyCronSecret(request)
+    expect(result).not.toBeNull()
+    expect(result!.status).toBe(401)
+  })
+})