fix: address 16 architecture design flaws across all crates

Phase 1 — Foundation:
- Constant-time token comparison via subtle::ConstantTimeEq (Fix 11)
- Structured error codes E001–E020 in new error_codes.rs (Fix 15)
- Remove dead envelope.capnp code and related types (Fix 16)

Phase 2 — Auth Hardening:
- Registration collision check via has_user_record() (Fix 5)
- Auth required on uploadHybridKey/fetchHybridKey RPCs (Fix 1)
- Identity-token binding at registration and login (Fix 2)
- Session token expiry with 24h TTL and background reaper (Fix 3)
- Bounded pending logins with 5-minute timeout (Fix 4)

Phase 3 — Resource Limits:
- Rate limiting: 100 enqueues/60s per token (Fix 6)
- Queue depth cap at 1000 + 7-day message TTL/GC (Fix 7)
- Partial queue drain via limit param on fetch/fetchWait (Fix 8)

Phase 4 — Crypto Fixes:
- OPAQUE KSF switched from Identity to Argon2id (Fix 10)
- Random AEAD nonce in hybrid KEM instead of HKDF-derived (Fix 12)
- Zeroize secret fields in HybridKeypairBytes (Fix 13)
- Encrypted client state files via QPCE format (Fix 9)

Phase 5 — Protocol:
- Commit fan-out to all existing members on invite (Fix 14)
- Add member_identities() to GroupMember

Breaking: existing OPAQUE registrations invalidated (Argon2 KSF).
Schema: added auth to hybrid key ops, identityKey to OPAQUE finish
RPCs, limit to fetch/fetchWait.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/quicnprotochat-server/src/storage.rs

@@ -43,6 +43,24 @@ pub trait Store: Send + Sync {
         channel_id: &[u8],
     ) -> Result<Vec<Vec<u8>>, StorageError>;
 
+    /// Fetch up to `limit` messages without draining the entire queue (Fix 8).
+    fn fetch_limited(
+        &self,
+        recipient_key: &[u8],
+        channel_id: &[u8],
+        limit: usize,
+    ) -> Result<Vec<Vec<u8>>, StorageError>;
+
+    /// Return the number of queued messages for (recipient, channel) (Fix 7).
+    fn queue_depth(
+        &self,
+        recipient_key: &[u8],
+        channel_id: &[u8],
+    ) -> Result<usize, StorageError>;
+
+    /// Delete messages older than `max_age_secs`. Returns count deleted (Fix 7).
+    fn gc_expired_messages(&self, max_age_secs: u64) -> Result<usize, StorageError>;
+
     fn upload_hybrid_key(
         &self,
         identity_key: &[u8],
@@ -62,6 +80,29 @@ pub trait Store: Send + Sync {
 
     /// Retrieve an OPAQUE user record by username.
     fn get_user_record(&self, username: &str) -> Result<Option<Vec<u8>>, StorageError>;
+
+    /// Check if a user record already exists (Fix 5).
+    fn has_user_record(&self, username: &str) -> Result<bool, StorageError>;
+
+    /// Store identity key for a user (Fix 2).
+    fn store_user_identity_key(
+        &self,
+        username: &str,
+        identity_key: Vec<u8>,
+    ) -> Result<(), StorageError>;
+
+    /// Retrieve identity key for a user (Fix 2).
+    fn get_user_identity_key(&self, username: &str) -> Result<Option<Vec<u8>>, StorageError>;
+
+    /// Publish a P2P endpoint address for an identity key.
+    fn publish_endpoint(
+        &self,
+        identity_key: &[u8],
+        node_addr: Vec<u8>,
+    ) -> Result<(), StorageError>;
+
+    /// Resolve a peer's P2P endpoint address.
+    fn resolve_endpoint(&self, identity_key: &[u8]) -> Result<Option<Vec<u8>>, StorageError>;
 }
 
 // ── ChannelKey ───────────────────────────────────────────────────────────────
@@ -100,10 +141,13 @@ pub struct FileBackedStore {
     hk_path: PathBuf,
     setup_path: PathBuf,
     users_path: PathBuf,
+    identity_keys_path: PathBuf,
     key_packages: Mutex<HashMap<Vec<u8>, VecDeque<Vec<u8>>>>,
     deliveries: Mutex<HashMap<ChannelKey, VecDeque<Vec<u8>>>>,
     hybrid_keys: Mutex<HashMap<Vec<u8>, Vec<u8>>>,
     users: Mutex<HashMap<String, Vec<u8>>>,
+    identity_keys: Mutex<HashMap<String, Vec<u8>>>,
+    endpoints: Mutex<HashMap<Vec<u8>, Vec<u8>>>,
 }
 
 impl FileBackedStore {
@@ -117,11 +161,13 @@ impl FileBackedStore {
         let hk_path = dir.join("hybridkeys.bin");
         let setup_path = dir.join("server_setup.bin");
         let users_path = dir.join("users.bin");
+        let identity_keys_path = dir.join("identity_keys.bin");
 
         let key_packages = Mutex::new(Self::load_kp_map(&kp_path)?);
         let deliveries = Mutex::new(Self::load_delivery_map(&ds_path)?);
         let hybrid_keys = Mutex::new(Self::load_hybrid_keys(&hk_path)?);
         let users = Mutex::new(Self::load_users(&users_path)?);
+        let identity_keys = Mutex::new(Self::load_map_string_bytes(&identity_keys_path)?);
 
         Ok(Self {
             kp_path,
@@ -129,10 +175,13 @@ impl FileBackedStore {
             hk_path,
             setup_path,
             users_path,
+            identity_keys_path,
             key_packages,
             deliveries,
             hybrid_keys,
             users,
+            identity_keys,
+            endpoints: Mutex::new(HashMap::new()),
         })
     }
 
@@ -245,6 +294,18 @@ impl FileBackedStore {
         }
         fs::write(path, bytes).map_err(|e| StorageError::Io(e.to_string()))
     }
+
+    fn load_map_string_bytes(path: &Path) -> Result<HashMap<String, Vec<u8>>, StorageError> {
+        Self::load_users(path)
+    }
+
+    fn flush_map_string_bytes(
+        &self,
+        path: &Path,
+        map: &HashMap<String, Vec<u8>>,
+    ) -> Result<(), StorageError> {
+        self.flush_users(path, map)
+    }
 }
 
 impl Store for FileBackedStore {
@@ -302,6 +363,46 @@ impl Store for FileBackedStore {
         Ok(messages)
     }
 
+    fn fetch_limited(
+        &self,
+        recipient_key: &[u8],
+        channel_id: &[u8],
+        limit: usize,
+    ) -> Result<Vec<Vec<u8>>, StorageError> {
+        let mut map = self.deliveries.lock().unwrap();
+        let key = ChannelKey {
+            channel_id: channel_id.to_vec(),
+            recipient_key: recipient_key.to_vec(),
+        };
+        let messages = map
+            .get_mut(&key)
+            .map(|q| {
+                let count = limit.min(q.len());
+                q.drain(..count).collect()
+            })
+            .unwrap_or_default();
+        self.flush_delivery_map(&self.ds_path, &*map)?;
+        Ok(messages)
+    }
+
+    fn queue_depth(
+        &self,
+        recipient_key: &[u8],
+        channel_id: &[u8],
+    ) -> Result<usize, StorageError> {
+        let map = self.deliveries.lock().unwrap();
+        let key = ChannelKey {
+            channel_id: channel_id.to_vec(),
+            recipient_key: recipient_key.to_vec(),
+        };
+        Ok(map.get(&key).map(|q| q.len()).unwrap_or(0))
+    }
+
+    fn gc_expired_messages(&self, _max_age_secs: u64) -> Result<usize, StorageError> {
+        // FileBackedStore does not track timestamps per message — no-op.
+        Ok(0)
+    }
+
     fn upload_hybrid_key(
         &self,
         identity_key: &[u8],
@@ -345,4 +446,39 @@ impl Store for FileBackedStore {
         let map = self.users.lock().unwrap();
         Ok(map.get(username).cloned())
     }
+
+    fn has_user_record(&self, username: &str) -> Result<bool, StorageError> {
+        let map = self.users.lock().unwrap();
+        Ok(map.contains_key(username))
+    }
+
+    fn store_user_identity_key(
+        &self,
+        username: &str,
+        identity_key: Vec<u8>,
+    ) -> Result<(), StorageError> {
+        let mut map = self.identity_keys.lock().unwrap();
+        map.insert(username.to_string(), identity_key);
+        self.flush_map_string_bytes(&self.identity_keys_path, &*map)
+    }
+
+    fn get_user_identity_key(&self, username: &str) -> Result<Option<Vec<u8>>, StorageError> {
+        let map = self.identity_keys.lock().unwrap();
+        Ok(map.get(username).cloned())
+    }
+
+    fn publish_endpoint(
+        &self,
+        identity_key: &[u8],
+        node_addr: Vec<u8>,
+    ) -> Result<(), StorageError> {
+        let mut map = self.endpoints.lock().unwrap();
+        map.insert(identity_key.to_vec(), node_addr);
+        Ok(())
+    }
+
+    fn resolve_endpoint(&self, identity_key: &[u8]) -> Result<Option<Vec<u8>>, StorageError> {
+        let map = self.endpoints.lock().unwrap();
+        Ok(map.get(identity_key).cloned())
+    }
 }