Implement security audit recommendations

[alari76]

Summary

• H1: Fix SSRF in Stepflow callback — invert allowedCallbackHosts guard to deny-by-default when unconfigured
• H2: Move auth token off WebSocket URL — use post-connect auth message handshake instead of query string to prevent log/referrer exposure
• H3: Stop forwarding master auth token to child processes — derive session-scoped HMAC tokens with limited privileges
• M1: Require explicit CORS_ORIGIN in production (NODE_ENV=production exits if unset)
• M3: Add per-IP WebSocket connection rate limiting (30/min) before handshake
• M4: Enforce 0600 permissions on all persisted state files (sessions, approvals, workflow config)
• M5: Add regex-based secret redaction to bash command logging (Bearer tokens, passwords, API keys)
• M6: Replace execSync('claude --version') with execFileSync to avoid shell invocation
• L1: Add Content-Security-Policy, Permissions-Policy, Strict-Transport-Security (production), change X-Frame-Options to DENY
• L3: Wrap createWorkspace in try/finally to clean up partial workspaces on failure
• L4: Tighten clone endpoint validation — reject names starting with . (blocks .git, ..)

Addresses all findings from the 2026-03-09 security audit.

Test plan

• All 855 existing tests pass
• Build succeeds with no errors
• Lint passes with 0 errors (only pre-existing warnings)
• Verify WebSocket auth message handshake works in browser
• Verify hook endpoints accept session-scoped tokens from child processes
• Verify Stepflow callbacks are rejected when STEPFLOW_CALLBACK_HOSTS is unset

🤖 Generated with Claude Code