fix: script secret leakage, TOTP throttling, impersonation audit, attachment IDOR

[unlimitedengineer]

Closes #587
Closes #590
Closes #605
Closes #606

• Audit shell scripts for secret leakage in logs #587 – Strip credentials from DATABASE_URL before printing in rehearse-migration-rollback.sh and rollback-migration.sh (${VAR##*@} extracts host-only); extend env-secret-scan.yml to also scan scripts/ and .github/workflows/ for secret variable echo patterns on every PR
• Security review: admin impersonation must be audit-logged, time-boxed, and blocked for high-risk workflows #590 – Write AdminAuditLog entries on impersonation start and end (action, target user, IP, session ID, reason); add blockHighRiskImpersonation middleware that denies impersonated tokens on withdrawals, erasure, API key management, treasury, MFA/TOTP routes; propagate ipAddress and reason through generateImpersonationToken
• TOTP verification needs per-account throttling and lockout #605 – Add per-account brute-force protection to totp.service.ts: 5-attempt lockout with 15-minute cooldown, constant-time code comparison via timingSafeEqual, time-step replay prevention, audit log on every failed attempt, and unlockTotpCredential admin helper
• Support-ticket attachments: validate refs, enforce size/type limits, define scan policy #606 – Enforce UUID format + 10-ref cap on attachmentRefs in all support ticket validators; add validateAttachmentRefs ownership check in create and reply handlers with IDOR logging; document MIME/size/scan policy for the upload endpoint

[drips-wave]

@unlimitedengineer Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits