chore(ci): pin the supply chain and surface build provenance

Every workflow action is pinned to a commit SHA, dependabot auto-merge
is limited to patch and minor updates behind the now-required status
checks on main, and the audit, Trivy and ESLint gates block instead of
warning. The published image finally carries its build SHA and build
timestamp so the version endpoint can prove which commit is running.
The API-token HMAC key fails closed under 32 characters, compose pins
the database minor and denies privilege escalation, and the changelog
drops working-note references in favour of neutral wording.

src/lib/auth/__tests__/hmac.test.ts

@@ -2,7 +2,7 @@ import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { verifyHmacSignature, hashToken } from "../hmac";
 import { createHmac } from "node:crypto";
 
-const TEST_HMAC_KEY = "test-hmac-key-for-unit-tests";
+const TEST_HMAC_KEY = "test-hmac-key-for-unit-tests-32-chars-min";
 
 beforeEach(() => {
   vi.stubEnv("API_TOKEN_HMAC_KEY", TEST_HMAC_KEY);
@@ -84,4 +84,19 @@ describe("hashToken", () => {
       "API_TOKEN_HMAC_KEY env var must be set",
     );
   });
+
+  it("throws if API_TOKEN_HMAC_KEY is shorter than 32 characters", () => {
+    vi.stubEnv("API_TOKEN_HMAC_KEY", "short-key-31-characters-xxxxxxx");
+    expect(() => hashToken("test")).toThrow(
+      "API_TOKEN_HMAC_KEY must be at least 32 characters, got 31",
+    );
+  });
+
+  it("accepts a key of exactly 32 characters", () => {
+    const key32 = "exactly-32-characters-long-key-x";
+    vi.stubEnv("API_TOKEN_HMAC_KEY", key32);
+    expect(key32).toHaveLength(32);
+    const expected = createHmac("sha256", key32).update("test").digest("hex");
+    expect(hashToken("test")).toBe(expected);
+  });
 });

src/lib/auth/hmac.ts

@@ -28,12 +28,23 @@ export function verifyHmacSignature(
 
 /**
  * Hash an API token for storage (SHA-256).
- * Requires API_TOKEN_HMAC_KEY env var to be set.
+ * Requires API_TOKEN_HMAC_KEY env var to be set and at least 32
+ * characters long. Fail-closed like the encryption-key loader in
+ * `src/lib/crypto.ts`: a weak key throws instead of silently keying
+ * every Bearer-token hash off guessable material.
  */
+const MIN_HMAC_KEY_LENGTH = 32;
+
 export function hashToken(token: string): string {
   const key = process.env.API_TOKEN_HMAC_KEY;
   if (!key) {
     throw new Error("API_TOKEN_HMAC_KEY env var must be set");
   }
+  if (key.length < MIN_HMAC_KEY_LENGTH) {
+    throw new Error(
+      `API_TOKEN_HMAC_KEY must be at least ${MIN_HMAC_KEY_LENGTH} characters, got ${key.length}. ` +
+        "Generate a strong key with `openssl rand -hex 32` and update the environment before restarting.",
+    );
+  }
   return createHmac("sha256", key).update(token).digest("hex");
 }