Fix account takeover and privilege escalation paths in the API

[kaareal]

A security review of the API turned up seven issues, verified individually before fixing. Each fix has a regression test. All 411 API tests pass.

What was wrong

#	Issue	Fix
1	roles had no writeAccess, so any signed-up user could PATCH /1/users/me with {"roles":[{"role":"superAdmin","scope":"global"}]} and become superAdmin. isTester was writable the same way, and it makes the login code a fixed value the response returns.	Both moved into a $staff scope, writable by admins only.
2	/auth/password/update accepted any access token. Unsubscribe links in notification emails carry that same type, so a leaked unsubscribe URL could set the password and return a full session, with no MFA step.	The route requires action === 'reset-password'.
3	enableTotp never set isMfa, so the recent-password check never ran and /auth/totp/login was a full login from email plus a 6-digit code.	verifyTotp always requires a password verified in the last 5 minutes.
4	Signup never verified the email, and Google/Apple login signed into any account matching the address, keeping the password whoever registered first had set. That person kept access to everything the real owner later added.	claimUnverifiedUser removes logins added before the email was proven.
5	fetchByParam passed ?include= straight through, and user email, phone and roles had no readAccess. GET /1/uploads/<id>?include=owner returned the uploader's contact details without a login; upload ids are public in image URLs.	Those fields are readable by self and staff roles only.
6	The products routes only called authenticate(), so any user could change or delete any product, or add one to someone else's shop.	Writes require products.write.
7	PATCH /1/docs and POST /1/docs/generate needed no login and were mounted everywhere, writing arbitrary paths into openapi.json, which /openapi.json serves.	Mounted in development only.

Two more came out of reviewing the fixes themselves:

• Marking an email verified without clearing the older logins let a squatter's passkey and sessions survive a password reset and skip the cleanup above. Password reset and invite accept now run the same cleanup.
• /otp/send defaulted to email whatever identifier named the account, so an sms login emailed the code and never set phoneVerified. The channel now follows the identifier, and /otp/login verifies the channel the code was actually sent to rather than the field used to look the user up. /otp/send, /otp/login and /totp/login now require exactly one of email or phone, which findUser previously resolved by silently preferring phone.

Behaviour changes worth knowing

• Someone who signed up with a password and never verified their email loses that password the first time they sign in with Google, Apple, or an email code. They recover it with a password reset, which goes to the inbox they have just proven they own.
• TOTP login now fails for an account with no password, since it always asks for a recent password.
• Login codes issued before this deploys have no channel recorded, so they verify nothing. They expire within the hour.
• A client sending both an email and a phone to the code login routes now gets a 400. Nothing in this repo does.

Not fixed here

Six lower-confidence findings were left out, including replayable invite tokens, admins being able to grant themselves superAdmin, and staging config with a hardcoded JWT_SECRET and admin password. Happy to open a follow-up.

[github-actions]

API Changes

Operations

• Changed POST /1/auth/otp/send
  • Removed body.channel.default
• Changed POST /1/products
  • Added x-permissions
• Changed PATCH /1/products/:id
  • Added x-permissions
• Changed DELETE /1/products/:id
  • Added x-permissions

[kaareal]

Closing in favour of smaller PRs, one per fix:

• Restrict user roles, tester flag and contact fields #316 Restrict user roles, tester flag and contact fields
• Require products.write for product writes #317 Require products.write for product writes
• Mount docs editing routes in development only #318 Mount docs editing routes in development only
• Accept only reset-password tokens on password update #319 Accept only reset-password tokens on password update
• Require a recent password for TOTP login #320 Require a recent password for TOTP login
• Send and verify login codes on the channel that named the account #321 Send and verify login codes on the channel that named the account
• 322 Clear pre-verification logins once the email is proven (stacked on Send and verify login codes on the channel that named the account #321)

Together they are identical to this PR's API source changes.