fix(security): comprehensive security hardening — TLS, HMAC WS auth, rate limiting, IP leak prevention

CRITICAL fixes:
- Auto-generated self-signed TLS certs (HTTPS/WSS by default)
- Removed session_key from /srp/verify response (was sent in plaintext)
- Replaced with HMAC-SHA256 ws_token for WebSocket authentication

HIGH fixes:
- WebSocket auth now validates ws_token via hmac.compare_digest()
- /clear endpoint requires Bearer admin_token (printed at server start)
- Password no longer required as CLI arg — supports env var + getpass prompt
- Removed user_ip from Message model (no longer broadcast to clients)

MEDIUM fixes:
- Rate limiter on /srp/init and /srp/verify (10 req/min/IP)
- MessageStore capped at 1000 messages (prevents RAM DoS)
- access_log disabled (was leaking request metadata)

LOW fixes:
- Username sanitization against rich markup injection
- Dead code removed from helpers.py

All 79 tests passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd_chat/server/factory.py

@@ -1,12 +1,13 @@
 import asyncio
+import secrets
 from contextlib import suppress
-from cryptography.fernet import Fernet
 from sanic import Sanic
 from sanic_ext import Extend
 import os
 from .managers import ConnectionManager
 from .stores import MessageStore, UserSessionStore
 from .srp_auth import SRPAuthManager
+from .helpers import RateLimiter
 
 from .routes import register_routes
 
@@ -20,6 +21,9 @@ def create_app(password: str = "", name: str = "cmd-chat-server") -> Sanic:
     app.ctx.connection_manager = ConnectionManager()
     app.ctx.srp_manager = SRPAuthManager(password)
     app.ctx.room_salt = os.urandom(16)
+    app.ctx.ws_secret = os.urandom(32)
+    app.ctx.admin_token = secrets.token_hex(16)
+    app.ctx.rate_limiter = RateLimiter(max_requests=10, window_seconds=60)
     app.ctx.cleanup_task = None
 
     register_lifecycle(app)