feat(security): code hardening pass (log hygiene, JWT/OIDC, image digests, dep CVEs, CodeQL/pip-audit/gitleaks)

[andasv]

Summary

Actionable in-code/infra/CI items from the post-public security review. The repo was already strongly hardened; operational items (key rotation, branch protection) are tracked separately and not in this PR.

Changes

Auth & logging

• Audit + auth-failure logs → stderr so they never corrupt the stdio MCP JSON-RPC stream (HTTP/Lambda still reach the log aggregator). [M1]
• Require JWT exp; reject non-expiring tokens. [L1]
• Enforce HTTPS for OIDC issuer/JWKS/hosted-UI (http only for localhost), closing a JWKS-MITM key-swap vector. [L2]

Infra

• Pin Docker base images to immutable digests (generic + Lambda). [M2]
• Scope the Lambda KMS Decrypt grant to this account+region's keys. [L4]

Docs

• Document the no-built-in-rate-limit residual risk + mitigations. [L3]

CI

• New CodeQL workflow (security-extended). [I1]
• pip-audit job (audits the locked env). [I1]
• gitleaks CLI job — pinned v8.30.1 + checksum-verified (the action requires a license for org repos; the binary doesn't). Corrected the outdated comment. [I3]

Dependency CVEs (surfaced by the new pip-audit, fixed in uv.lock)

• starlette 0.52.1 → 1.2.1 (PYSEC-2026-161, runtime)
• pytest 8.4.2 → 9.0.3 (CVE-2025-71176, dev)

Verification

• 73 tests pass (incl. 3 new auth tests) on the starlette 1.x major bump
• ruff / ruff format / pyright clean
• terraform fmt clean; gitleaks scan clean (20 commits, no leaks); pip-audit reports no known vulnerabilities
• All GitHub Actions SHA-pinned; base-image digests verified against the registry

Not in this PR (manual / operator)

• H1: rotate previously-exposed ANTHROPIC_API_KEY + WorkOS key
• Branch protection on main

🤖 Generated with Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.