Cockpit: harden remote auth, sessions, CSRF, headers, and rate limits

[smota]

Background & Problem Statement

Epic: #119

Cockpit has MVP GitHub OAuth/session scaffolding, but it is not production-hardened for internet-facing remote use.

Proposed Solution

Harden the remote service security baseline before public/team exposure.

Requirements

• Persistent session store or signed/encrypted stateless session strategy.
• Full CSRF token plumbing for browser forms and guarded actions.
• Security headers: CSP, frame-ancestors, X-Content-Type-Options, Referrer-Policy, Permissions-Policy.
• Rate limiting for login, OAuth callback, and write/action endpoints.
• Secure cookie settings for remote HTTPS deployment.
• OAuth E2E tests against a test/dummy provider or mocked callback flow.
• Audit log hardening and rotation/retention guidance.

Acceptance criteria

• Remote mode fails closed when session secret/OAuth config invalid.
• CSRF negative tests cover guarded action endpoint.
• Security headers present on HTML responses.
• Rate-limit tests cover repeated auth/action requests.
• Session expiry/logout behavior tested.
• Docs explain internet-facing hardening.

Test plan

• Unit/integration tests for sessions, CSRF, headers, rate limits.
• Manual remote-mode smoke with GitHub OAuth test app.

Workflow classification

High-assurance security hardening. Requires security review and human acceptance.

[github-actions]

Integrated into development by PR #133: #133

Merge commit: 823d2e784f61e11645d2902e35401134fe0b1bdc
Release/promotion to main is tracked separately.