Harden identity flows after review
Move single-use auth state (email links, WebAuthn challenges, pending 2FA logins) from KV to D1 with atomic consume/attempt counting; reject regressed passkey counters atomically; issue recovery codes with the first passkey; revoke PATs and pending logins on password reset; require a recent sign-in for password-less re-auth and a password for renames; restrict avatar uploads to sessions; supersede stale email-change links; release redirects when a name is claimed; bounds-check DER signatures; fix canonical repo redirects.
20 files changed+277−113
Rendering diff…