Harden security model and refresh UI to an editorial Obsidian Gallery theme

[isiliconx]

This pull request was created by @kiro-agent on behalf of @isiliconx 👻

Comment with /kiro fix to address specific feedback or /kiro all to address everything.
_{Learn about Kiro autonomous agent}

---

Summary

This PR addresses every issue from the recent code review and reskins the app to a more refined aesthetic.

Security & correctness

• Single source of config (server/config.js). Production fail-fast on missing/placeholder JWT_SECRET; development gets an ephemeral random secret with a clear warning. No more duplicate secret reads in auth.js and index.js.
• Authorization on every transfer event. Only the sender can push chunks or mark a transfer complete; only the recipient can accept or reject; cancel requires the caller to be a party. UUID transferIds alone are not sufficient.
• Chunk payloads are size-bounded (3 MiB hard cap) and shape-validated before being relayed. Socket.IO maxHttpBufferSize lowered from 100 MiB to 4 MiB.
• Idle transfer sweep auto-cancels abandoned transfers (default: no chunk activity for 60 s). Prevents memory leaks when a sender ghosts mid-stream. Cancel events now carry a reason field (cancelled_by_peer | peer_disconnected | idle_timeout).
• Rate limiting (no extra deps): per-IP sliding window on /login (5/15 m) and /register (5/1 h); per-socket on chat messages.
• Atomic, serialized writes to users.json. The previous read-modify-write was racy; now goes through a single-writer queue with temp-file + rename.
• Constant-ish-time login: bcrypt compare runs even on missing user, mitigating user-enumeration via timing.
• Stronger defaults: bcrypt cost 12, password min length 8.
• Security headers (no helmet dep): X-Content-Type-Options, X-Frame-Options: DENY, Referrer-Policy: no-referrer, Permissions-Policy locking down camera/mic/geo/payment, and a tight CSP allowing self + Google Fonts + Socket.IO CDN. Plus compression.
• CORS allowlist: defaults to same-origin (recommended for LAN), supports comma-separated allowlist or * via env.
• Scoped catch-all: /api/* fall-throughs now return JSON 404 instead of the SPA shell.
• Graceful shutdown on SIGINT/SIGTERM/uncaughtException, with a server:shutdown broadcast and 10 s force-exit safety net.
• Multi-tab awareness: a user's transfers aren't cancelled when one of several tabs disconnects.

Client cleanups

• Removed the unused logout import and the dynamic import('./app.js') workaround for the circular dependency in auth.js.
• escapeHtml rewritten as a regex+lookup table (no DOM allocation).
• Browser Notifications are now opt-in and only fire when the tab is hidden, ending the prior toast-spam behaviour.
• pendingFile is now a correlation-id Map, removing the race when multiple transfer requests are in flight.
• Page-wide drag-and-drop: drop anywhere on the dashboard, not just inside the dropzone.
• Live transfer rate + ETA on every card (rolling 0.5 s sample window).
• Cancel button on every active transfer.
• Multiple incoming requests queue cleanly so none are lost.
• 429 retryAfter now surfaced in the auth UI.

UI — Obsidian Gallery theme

A full reskin built around restraint:

• Graded obsidian surfaces (--ink-0 through --ink-4), platinum text scale (--pearl-100 through --pearl-05), champagne-gold accents.
• Typography: Cormorant Garamond for the wordmark and section headings; Inter for body. The italic Drop in the brand carries the gold gradient.
• Subtle SVG noise grain over the obsidian field; three slow aurora orbs (champagne, plum, slate) drift over 38–54 s.
• All emojis replaced with an inline SVG sprite (hex, user, lock, power, upload, download, inbox, chat, send, close).
• Hairline borders, deep soft shadows, tabular numerals for sizes and percentages.
• New page-wide drag overlay with a champagne-tinted dashed border.
• prefers-reduced-motion is honoured.
• New theme-color / color-scheme metas; ARIA attributes on modals, tabs, and the toast region.

Testing

• All server and client modules pass node --check.
• End-to-end HTTP smoke test confirms:
  • 200 on GET / with full security header set
  • Register/login/me/error paths return correct codes (201 / 400 / 409 / 401 / 200)
  • /api/unknown returns JSON 404 (scoped catch-all working)
  • Rate limiter activates exactly per spec (6th attempt → 429)
  • Graceful SIGINT shutdown completes cleanly

Notes for reviewers

• One new dependency: compression (~10 KB).
• JWT_SECRET in .env is now blank by default (so dev gets the auto-generated ephemeral secret). For production, set it to a long random string (the example has the one-liner).
• The old users.json schema is unchanged; existing accounts work without migration. Existing passwords stay valid (any new ones are hashed at cost 12).