qa(security): add supply-chain, fuzz, and authz coverage

[UberMetroid]

Summary

Adds security test coverage and supply-chain controls for the scan backend.

Changes

• CI: .github/workflows/security.yml

  • cargo-deny (advisories, bans, licenses, sources)
  • cargo-audit against the RustSec advisory DB
  • gitleaks secret scan (config in .gitleaks.toml)
  • cargo-cyclonedx SBOM generation in JSON + XML (artifact uploaded)
  • Repository secret-pattern scanner (AWS keys, GitHub PATs, private-key blocks)
  • Triggers on push, pull_request, weekly cron, and manual dispatch

• Fuzz harnesses (fuzz/)

  • board_parsing: LeaderboardEntry JSON round-trip + sanitiser
  • mine_layout: deterministic mine-placement invariants
  • pin_helper: PIN length window + cookie_should_be_secure policy

• Authz integration suite (backend/tests/authz/) — 37 tests

  • Origin policy: missing / cross-origin / mixed-case / matching / GET bypass
  • RequirePin: GET/POST gated, session cookie, x-pin header, logout revocation, PIN length window, constant-time compare, canonical cookie name, HttpOnly / SameSite=Strict
  • Per-IP rate limit: budget exhaustion, header hygiene, scan_requests_429_total counter
  • Body limit: 413 on oversized /api/verify-pin and /api/leaderboard payloads
  • Leaderboard cap: MAX_LEADERBOARD_ENTRIES truncation + sort, name sanitiser, anonymous fallback
  • Security headers: present on redirect / API / error / metrics / ready
  • Observability: /metrics text-plain Prometheus, never rate-limited, no token leak; /ready 200/503, unauthenticated even when PIN set

• Developer helpers (scripts/)

  • sbom.sh metadata|cyclonedx — local SBOM generator
  • secret-scan.sh — local credential-pattern scanner

Validation

• cargo build --workspace ✓
• cargo test --workspace ✓ (156 tests pass; 37 new in authz)
• cargo clippy -p backend --tests ✓ (no warnings on new code)
• python -c 'import yaml; yaml.safe_load(...)' on workflow ✓
• cargo +nightly build --bin board_parsing (one fuzz target builds)

Limitations

• The fuzz targets exercise a deterministic re-implementation of the mine-placement algorithm in fuzz/fuzz_targets/mine_layout.rs. The production path (frontend/src/components/scan_logic.rs) draws from js_sys::Math::random, which is non-deterministic by design and only runs inside the Wasm frontend — fuzzing it from cargo-fuzz would require Wasm-side harness support beyond the scope of this PR.
• The pin_helper fuzz target mirrors the production cookie_should_be_secure / parse_translation_env helpers inline rather than depending on the (private) production symbols, so future production changes to those helpers should be propagated to the fuzz target.
• The fuzz workspace uses fuzz/Cargo.lock; CI re-fetches it on each run via cargo fuzz build.
• The CI workflow installs the heavyweight tools (cargo-deny, cargo-audit, cargo-cyclonedx) on every run; cache the toolchain if this becomes a bottleneck.