[fionera]

What

• Generate a bh@ support ID in HAProxy for the initial challenge GET and pass it to SPOE as an argument.
• Embed the support ID in the existing r value alongside the expiry timestamp.
• Sign the entire r value with the existing Berghain HMAC secret in s.
• Keep the compact r-s-nonce continuation body unchanged; no JSON decoding, correlation header, cookie, HAProxy state, or additional key is used.
• Verify s before exposing the embedded ID to structured log context.
• Display the same ID in the challenge page and keep the trailing initial SPOP argument optional.

Why

Visitors need a support reference that operators can correlate with one challenge attempt. HAProxy chooses the initial value, while the existing signed challenge token carries it safely across connections without adding state or another client-controlled channel.

Validation

• go test ./... in Go 1.24
• npm run lint
• npm run build
• HAProxy configuration validation
• Docker Compose build and startup
• Live compact GET to POST flow issued a clearance cookie
• Tampering with the embedded ID returned invalid hmac, issued no clearance cookie, and added no session log attribute