fix: meta-critic tiers 1-3 — security, architecture, tests

[AlexU-A]

Summary

Addresses 16 findings from a 13-lane parallel meta-critic review of the entire repository, covering the top 3 priority tiers.

Tier 1 — Real Bugs (5 fixes)

• SearchService interface mismatch — removed duplicate interface in retriever.ts, eliminated as unknown as unsafe casts in production init path
• Inngest empty registry — replaced static empty registry with lazy proxy singleton (inngest/registry.ts) that delegates to the real registry once pipeline module initializes
• content_search uses LIKE — wired SearchService FTS into the MCP tool handler with graceful LIKE fallback
• verify_branch always returns match:true — now reads expected branch from StateStore snapshot
• (Python score_against fix in separate PR for _private/joyus-profile-engine)

Tier 2 — Pre-Deploy Blockers (5 fixes)

• Weak encryption — replaced CryptoJS passphrase-mode AES with Node native crypto AES-256-GCM (random IV + auth tag). Fail-closed in production when key missing.
• Pipeline routes unauthenticated — added requireBearerToken middleware to /api route mount
• Tenant spoofing — getTenantId() no longer trusts x-tenant-id header; derives from authenticated session/user only
• Session secret — fail-closed in production when SESSION_SECRET not set
• Env validation — new src/config.ts with Zod-based validation at startup

Tier 3 — Pre-Users (6 fixes)

• CSRF — disconnect route changed from GET to POST; SameSite=lax on session cookie
• XSS — escapeHtml() applied to all user values in scheduler HTML templates
• CSP — enabled Content Security Policy via helmet
• Rate limiting — express-rate-limit on auth (20/15min) and API (100/15min) routes
• Entitlement cache — wired periodic 5-minute cleanup interval with unref()
• Auth tests — 55 new tests for auth/routes.ts and auth/verify.ts (was 0% coverage)

Governance & Documentation (bundled)

• Constitution v1.7 — added §5.4 "MCP Architecture": four-server domain boundary, mandatory domain prefixing, Tool Search-optimized description guidelines, no MCP for internal integrations, per-agent MCP isolation pattern
• Spec 010 backfill — added research.md and requirements checklist documenting the completed Inngest evaluation spike
• Spec 011 task files — WP01–WP04 task breakdowns with completion status
• .gitignore — allowlisted 011 task files

Files Changed

• 30 files changed, +1,648 / -112 lines
• 12 new files: src/config.ts, src/inngest/registry.ts, tests/auth/routes.test.ts, tests/auth/verify.test.ts, kitty-specs/010-inngest-evaluation/research.md, kitty-specs/010-inngest-evaluation/research/research.md, kitty-specs/010-inngest-evaluation/checklists/requirements.md, kitty-specs/011-inngest-migration/tasks/WP01-port-remaining-pipelines.md, kitty-specs/011-inngest-migration/tasks/WP02-update-routes.md, kitty-specs/011-inngest-migration/tasks/WP03-delete-custom-plumbing.md, kitty-specs/011-inngest-migration/tasks/WP04-integration-tests.md
• New dependency: express-rate-limit
• crypto-js is now unused and can be removed in a follow-up

Test plan

• npx tsc --noEmit — 0 errors
• npx vitest run (mcp-server) — 420 passed, 0 failed
• npx vitest run (state) — 433 passed, 2 pre-existing flaky failures (git collector env issue)
• Python profile engine — 555 passed (separate repo)
• Manual: verify scheduler UI renders correctly with escaped HTML
• Manual: verify disconnect button works as POST form
• Manual: confirm rate limiting headers appear on API responses

🤖 Generated with Claude Code

[grndlvl]

Additional Requested Changes

MCP Token Display Hardening

The MCP bearer token (generateMcpToken) is currently displayed in full on the dashboard every time. Needs:

1. Show once — Display the full token only immediately after user creation (use a session flash). On subsequent dashboard visits, show only the first 8 characters masked (e.g., a1b2c3d4...). Remove the "Copy" button when masked.

2. Regenerate endpoint — Add a POST /auth/regenerate-token route that generates a new MCP token, replaces the old one in the DB, and flashes the new token for one-time display. Include a confirmation step or button on the dashboard.