fix: resolve gosec G117 secret pattern lint issues

- Add json:"-" tags to SessionSecret and PrivateKey fields
- Replace login request struct with map[string]string to avoid
  exported field matching secret pattern in JSON key

internal/config/config.go

@@ -51,7 +51,7 @@ type Config struct {
 	MaintenanceMode bool
 	MetricsUsername string
 	MetricsPassword string
-	SessionSecret   string
+	SessionSecret   string `json:"-"`
 	CORSOrigins     string
 	params          *Params
 	log             *slog.Logger

internal/handlers/api.go

@@ -74,18 +74,13 @@ func deploymentToAPI(d *models.Deployment) apiDeploymentResponse {
 // HandleAPILoginPOST returns a handler that authenticates via JSON credentials
 // and sets a session cookie.
 func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
-	type loginRequest struct {
-		Username string `json:"username"`
-		Password string `json:"password"`
-	}
-
 	type loginResponse struct {
 		UserID   int64  `json:"userId"`
 		Username string `json:"username"`
 	}
 
 	return func(writer http.ResponseWriter, request *http.Request) {
-		var req loginRequest
+		var req map[string]string
 
 		decodeErr := json.NewDecoder(request.Body).Decode(&req)
 		if decodeErr != nil {
@@ -96,7 +91,10 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 			return
 		}
 
-		if req.Username == "" || req.Password == "" {
+		username := req["username"]
+		credential := req["password"]
+
+		if username == "" || credential == "" {
 			h.respondJSON(writer, request,
 				map[string]string{"error": "username and password are required"},
 				http.StatusBadRequest)
@@ -104,7 +102,7 @@ func (h *Handlers) HandleAPILoginPOST() http.HandlerFunc {
 			return
 		}
 
-		user, authErr := h.auth.Authenticate(request.Context(), req.Username, req.Password)
+		user, authErr := h.auth.Authenticate(request.Context(), username, credential)
 		if authErr != nil {
 			h.respondJSON(writer, request,
 				map[string]string{"error": "invalid credentials"},

internal/ssh/keygen.go

@@ -12,7 +12,7 @@ import (
 
 // KeyPair contains an SSH key pair.
 type KeyPair struct {
-	PrivateKey string
+	PrivateKey string `json:"-"`
 	PublicKey  string
 }