fix(security): vault Argon2id + XChaCha20-Poly1305 + safe v0→v1 migration (H2/L3)

[willamhou]

PR-B of the security-hardening plan. Findings H2 (weak vault KDF + dev password) and L3 (AES-GCM nonce). The migration design uses per-record versioning + explicit migrate (revised after a plan-review BLOCKER on store-wide switching).

Crypto

• Argon2id key derivation (per-vault random salt + pinned params persisted in kdf.json, OWASP floor m=19456,t=2,p=1), via hash_password_into (raw key, not the PHC verifier).
• XChaCha20-Poly1305 AEAD (24-byte random nonce → L3 nonce-collision concern gone), with AAD = site_id so a record can't be copied to another site and decrypted.
• v1 records carry a 0x01 version byte.

Migration safety (the careful part)

• Legacy v0 records (AES-256-GCM, SHA-256 key) stay readable via per-record dispatch (try v1 when the version byte + AEAD tag verify, else v0). A mixed store never locks out; a v0 record whose nonce happens to start with 0x01 still decrypts (v1 tag fails → v0 fallback).
• relais vault migrate re-encrypts all records to v1 (idempotent, crash-safe — partial migration stays readable).
• kdf.json loss protection: a reserved db marker records initialisation, so a missing kdf.json while the vault was initialised is refused (not silently regenerated — which would permanently lock out credentials). A corrupted kdf.json errors, never regenerates. kdf.json is written durably (temp + fsync + rename + parent-dir fsync).

Dev password

• Remove the silent relais-dev-password default: require RELAIS_VAULT_PASSWORD; the old default only under RELAIS_ALLOW_DEV_VAULT_PASSWORD=1|true. exec/serve degrade to no-vault when unset.

Tests

v1 round-trip + kdf.json; reads legacy v0; v0-record-starting-with-0x01 fallback; migrate→reopen; missing-kdf-with-marker refuses; corrupted-kdf errors; AAD blocks cross-site copy; wrong-password fails; CLI vault migrate parse. cargo test --workspace green; clippy clean.

Codex-reviewed; both BLOCKERs (kdf regeneration lockout, parent-dir fsync) and the cross-site AAD MEDIUM are fixed. A follow-up will tighten open_vault().ok() error visibility in exec/serve (Q5).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e36122d704

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Defer the KDF marker until a v1 write

Opening an existing legacy v0-only vault now writes KDF_MARKER even if no credential is migrated or stored as v1. If that generated kdf.json is later omitted from a backup/restore or otherwise lost, load_kdf refuses to open the vault solely because this marker exists, even though all remaining records are still v0 and decryptable with just the password; this can lock users out after a read-only open of an old vault. Consider recording the marker when the first v1 record is actually written/migrated, not during initial v0-compatible open.

Useful? React with 👍 / 👎.