feat: v0.2.1 security hardening

[msitarzewski]

Summary

Comprehensive security hardening for the signaling server, client, and deployment infrastructure:

• JWT Authentication: Room tokens (24h) prove peerId + roomId + role; invite tokens (4h) for authenticated link sharing. Only host/ops can generate invites.
• WebSocket Rate Limiting: Sliding-window limiter (100 signaling/10s, 500 stream-chunk/10s), per-IP connection cap (10), 256KB maxPayload.
• HTTP Security Headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin on all responses.
• CORS Allowlist: ALLOWED_ORIGINS env var for production; empty = allow all (dev mode).
• Role-Based Access Control: Server-side enforcement — streaming, invite generation, and producer muting restricted to host/ops roles.
• ICE Credential Protection: TURN credentials delivered via authenticated WebSocket (room-created/room-joined), removed from public /api/station API.
• Icecast Proxy Hardening: Path sanitization (posix.normalize, block traversal, block /admin), CORS on proxy responses.
• Icecast Entrypoint: Fail-fast credential validation — container won't start without passwords set.
• Docker Security: Non-root user in Dockerfile, production Icecast bound to 127.0.0.1.
• Input Validation: UUID v4 regex for peerId, from-field spoofing prevention.
• Tests: Updated all peer IDs to valid UUID v4 format.

Files changed: 25 files, +767 −187

Area	Files
New	server/lib/auth.js
Server	server.js, websocket-server.js, message-validator.js, static-server.js, icecast-listener-proxy.js, icecast-proxy.js
Client	main.js, signaling-client.js, rtc-manager.js, icecast-streamer.js
Infra	Dockerfile, docker-compose.yml, docker-compose.prod.yml, entrypoint.sh
Config	.env.example, station-manifest.sample.json, station-manifest.production.json
Tests	test-signaling.js, test-rooms.js
Docs	memory-bank/ (5 files updated)

Test plan

• npm test — all 18 tests pass with UUID v4 peer IDs
• Manual: rate limiting triggers error after burst
• Manual: connection limit (11th connection from same IP gets 4008)
• Manual: create room → token returned, invite token flow works
• Manual: guest cannot start stream or generate invites
• Manual: /stream/../admin returns 403
• Verify security headers in browser DevTools (Network tab)
• Deploy with ALLOWED_ORIGINS set, verify CORS blocks other origins

🤖 Generated with Claude Code