fix(security): comprehensive security hardening — TLS, HMAC WS auth, rate limiting, IP leak prevention

CRITICAL fixes:
- Auto-generated self-signed TLS certs (HTTPS/WSS by default)
- Removed session_key from /srp/verify response (was sent in plaintext)
- Replaced with HMAC-SHA256 ws_token for WebSocket authentication

HIGH fixes:
- WebSocket auth now validates ws_token via hmac.compare_digest()
- /clear endpoint requires Bearer admin_token (printed at server start)
- Password no longer required as CLI arg — supports env var + getpass prompt
- Removed user_ip from Message model (no longer broadcast to clients)

MEDIUM fixes:
- Rate limiter on /srp/init and /srp/verify (10 req/min/IP)
- MessageStore capped at 1000 messages (prevents RAM DoS)
- access_log disabled (was leaking request metadata)

LOW fixes:
- Username sanitization against rich markup injection
- Dead code removed from helpers.py

All 79 tests passing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/test_client.py

@@ -52,14 +52,19 @@ class TestClientInit:
         assert client.username == "testuser"
         assert client.password == b"testpassword"
         assert client.user_id is None
-        assert client.fernet is None
+        assert client.ws_token is None
         assert client.room_fernet is None
         assert client.connected is False
         assert client.running is False
 
     def test_client_urls(self, client):
-        assert client.base_url == "http://127.0.0.1:3000"
-        assert client.ws_url == "ws://127.0.0.1:3000"
+        assert client.base_url == "https://127.0.0.1:3000"
+        assert client.ws_url == "wss://127.0.0.1:3000"
+
+    def test_client_no_tls_urls(self):
+        c = Client("127.0.0.1", 3000, "user", "pass", no_tls=True)
+        assert c.base_url == "http://127.0.0.1:3000"
+        assert c.ws_url == "ws://127.0.0.1:3000"
 
     def test_client_empty_password(self):
         client = Client("localhost", 8080, "user", None)