[fclairamb]

Security fixes from the daily security scans (specs filed in this PR, now implemented).

What changed

• X1 (high): a personal access token is bound to one org. It can no longer call switch-org, mint sessions or device-consent tokens, or change sign-in factors (password, 2FA, passkeys, email). It gets 403 PAT_FORBIDDEN. sp auth switch-org on a PAT login explains what to do. Registering a passkey now emails the owner.
• X2 (medium): status-page subscribe no longer un-confirms a confirmed subscriber. Confirm emails are budgeted (3 per recipient, 100 per page, 20 per IP per hour, configurable via SP_STATUS_SUBSCRIBERS_CONFIRM_PER_*_PER_HOUR). Unconfirmed rows expire after 7 days (new column confirm_sent_at in migration 031).
• X3 (medium): invite-token lookup is one keyed lookup, not a scan of every organization. Breaking: invitations created before this release are no longer found; admins must re-send them.
• X4 (low): the SNMP community string is stored as a secret and no longer returned by the API or exports.
• Batch gate: fixed the env-var docs accessors for the new subscribe budgets. Full Go suite, lint and Playwright (980 passed) green.

Decided by autopilot

• X1, PAT calling switch-org: not allowed at all (recommended answer).
• X1, DELETE /auth/2fa keeps sharing the login budget (recommended answer).
• X2, budgets 3 / 100 / 20 per hour as config values (recommended answer).
• X3, no fallback for pre-upgrade invites; noted in the commit for the changelog (recommended answer).

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 91.70306% with 19 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.74%. Comparing base (ea540e8) to head (a1bd9dc).

Files with missing lines	Patch %	Lines
...ver/internal/handlers/statussubscribers/service.go	89.55%	7 Missing ⚠️
server/internal/handlers/auth/service.go	81.25%	6 Missing ⚠️
server/internal/handlers/auth/device_handler.go	0.00%	2 Missing ⚠️
...erver/internal/db/models/status_page_subscriber.go	83.33%	1 Missing ⚠️
...ver/internal/db/postgres/status_page_subscriber.go	92.85%	1 Missing ⚠️
...erver/internal/db/sqlite/status_page_subscriber.go	92.85%	1 Missing ⚠️
server/internal/handlers/auth/handler.go	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #699      +/-   ##
==========================================
+ Coverage   89.72%   89.74%   +0.01%     
==========================================
  Files        1292     1295       +3     
  Lines      131787   131964     +177     
==========================================
+ Hits       118247   118432     +185     
+ Misses      13531    13523       -8     
  Partials        9        9              

Files with missing lines	Coverage Δ
server/internal/app/server.go	92.02% <100.00%> (+<0.01%)	⬆️
...nternal/checkers/checksnmp/config/secret_fields.go	100.00% <100.00%> (ø)
server/internal/config/config.go	94.00% <100.00%> (+0.01%)	⬆️
server/internal/config/envvars.go	100.00% <100.00%> (ø)
server/internal/config/status_subscribers.go	100.00% <100.00%> (ø)
server/internal/email/supportreply.go	92.68% <ø> (ø)
server/internal/handlers/auth/device_service.go	90.17% <100.00%> (+0.11%)	⬆️
server/internal/handlers/auth/email_change.go	89.18% <100.00%> (+0.14%)	⬆️
server/internal/handlers/auth/join_policy.go	87.38% <100.00%> (+0.63%)	⬆️
server/internal/handlers/auth/passkey_notice.go	100.00% <100.00%> (ø)
... and 16 more

... and 26 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.