security(relay): harden internet-facing relay server

Closes the account-takeover chain and related issues found in audit:

- WS auth brute-force protection: per-session lockout (authThrottle) + per-
  socket failure cap that closes the socket (1008); applied to both web-client
  and desktop auth. Failed auth no longer leaves the socket open for unlimited
  guesses.
- WS upgrades now pass an IP-based rate limiter and Origin allowlist before
  handleUpgrade (previously bypassed all HTTP middleware); trust proxy set so
  limiting keys on the real client IP.
- /health no longer leaks live session IDs (counts only).
- .env.example rate-limit fixed (900000ms / 300) from the accidental ~11k rps.
- Credentials moved out of URLs into the X-MacroPad-Password header; images
  fetched via header + blob URLs; login stores creds in sessionStorage.
- Session creation bounded (max sessions, min password length) and TTL-pruned;
  session store writes are now atomic (temp+rename) and debounced.
- Session IDs lengthened to 12 chars with rejection sampling (no modulo bias).
- Enable helmet CSP; restrict CORS to configured origins.
- Request IDs use crypto.randomUUID; drop postinstall build hook and uuid dep.
- Uniform response for unknown session IDs (removes enumeration oracle).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

macropad-relay/src/utils/idGenerator.ts

@@ -1,31 +1,40 @@
 // Unique ID generation utilities
 
-import { randomBytes } from 'crypto';
+import { randomBytes, randomUUID } from 'crypto';
 
 const BASE62_CHARS = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
 
+// Largest multiple of 62 that fits in a byte (62 * 4 = 248). Bytes >= 248
+// are rejected so every character is drawn with uniform probability
+// (avoids modulo bias from `byte % 62`).
+const REJECTION_THRESHOLD = Math.floor(256 / BASE62_CHARS.length) * BASE62_CHARS.length;
+
 /**
- * Generate a random base62 string of specified length.
- * Uses cryptographically secure random bytes.
+ * Generate a random base62 string of the specified length.
+ * Uses cryptographically secure random bytes with rejection sampling
+ * to eliminate modulo bias.
  */
-export function generateSessionId(length: number = 6): string {
-  const bytes = randomBytes(length);
+export function generateSessionId(length: number = 12): string {
   let result = '';
 
-  for (let i = 0; i < length; i++) {
-    result += BASE62_CHARS[bytes[i] % BASE62_CHARS.length];
+  while (result.length < length) {
+    // Over-fetch a little to reduce the number of syscalls when rejecting.
+    const bytes = randomBytes(length);
+    for (let i = 0; i < bytes.length && result.length < length; i++) {
+      const byte = bytes[i];
+      if (byte >= REJECTION_THRESHOLD) {
+        continue; // reject to avoid bias
+      }
+      result += BASE62_CHARS[byte % BASE62_CHARS.length];
+    }
   }
 
   return result;
 }
 
 /**
- * Generate a UUID v4 for request IDs.
+ * Generate a UUID v4 for request IDs using the crypto module.
  */
 export function generateRequestId(): string {
-  return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
-    const r = Math.random() * 16 | 0;
-    const v = c === 'x' ? r : (r & 0x3 | 0x8);
-    return v.toString(16);
-  });
+  return randomUUID();
 }