feat: add CSRF protection, SSRF prevention, and login rate limiting (#42)

## Security Hardening

This PR implements three security hardening issues:

### CSRF Protection (closes #35)

- Session-based CSRF tokens with cryptographically random 256-bit generation
- Constant-time token comparison to prevent timing attacks
- CSRF middleware applied to `/pages`, `/sources`, `/source`, and `/user` routes
- Hidden `csrf_token` field added to all 12+ POST forms in templates
- Excluded from `/webhook` (inbound webhook POSTs) and `/api` (stateless API)

### SSRF Prevention (closes #36)

- `ValidateTargetURL()` blocks private/reserved IP ranges at target creation time
- Blocked ranges: `127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `169.254.0.0/16`, `::1`, `fc00::/7`, `fe80::/10`, plus multicast, reserved, test-net, and CGN ranges
- SSRF-safe HTTP transport with custom `DialContext` in the delivery engine for defense-in-depth (prevents DNS rebinding attacks)
- Only `http` and `https` schemes allowed

### Login Rate Limiting (closes #37)

- Per-IP rate limiter using `golang.org/x/time/rate`
- 5 attempts per minute per IP on `POST /pages/login`
- GET requests (form rendering) pass through unaffected
- Automatic cleanup of stale per-IP limiter entries every 5 minutes
- `X-Forwarded-For` and `X-Real-IP` header support for reverse proxies

### Files Changed

**New files:**
- `internal/middleware/csrf.go` + tests — CSRF middleware
- `internal/middleware/ratelimit.go` + tests — Login rate limiter
- `internal/delivery/ssrf.go` + tests — SSRF validation + safe transport

**Modified files:**
- `internal/server/routes.go` — Wire CSRF and rate limit middleware
- `internal/handlers/handlers.go` — Inject CSRF token into template data
- `internal/handlers/source_management.go` — SSRF validation on target creation
- `internal/delivery/engine.go` — SSRF-safe HTTP transport for production
- All form templates — Added hidden `csrf_token` fields
- `README.md` — Updated Security section and TODO checklist

`docker build .` passes (lint + tests + build).

Co-authored-by: clawbot <clawbot@noreply.git.eeqj.de>
Co-authored-by: clawbot <clawbot@eeqj.de>
Co-authored-by: Jeffrey Paul <sneak@noreply.example.org>
Reviewed-on: #42
Co-authored-by: clawbot <clawbot@noreply.example.org>
Co-committed-by: clawbot <clawbot@noreply.example.org>

internal/delivery/ssrf_test.go

@@ -0,0 +1,142 @@
+package delivery
+
+import (
+	"net"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestIsBlockedIP_PrivateRanges(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		ip      string
+		blocked bool
+	}{
+		// Loopback
+		{"loopback 127.0.0.1", "127.0.0.1", true},
+		{"loopback 127.0.0.2", "127.0.0.2", true},
+		{"loopback 127.255.255.255", "127.255.255.255", true},
+
+		// RFC 1918 - Class A
+		{"10.0.0.0", "10.0.0.0", true},
+		{"10.0.0.1", "10.0.0.1", true},
+		{"10.255.255.255", "10.255.255.255", true},
+
+		// RFC 1918 - Class B
+		{"172.16.0.1", "172.16.0.1", true},
+		{"172.31.255.255", "172.31.255.255", true},
+		{"172.15.255.255", "172.15.255.255", false},
+		{"172.32.0.0", "172.32.0.0", false},
+
+		// RFC 1918 - Class C
+		{"192.168.0.1", "192.168.0.1", true},
+		{"192.168.255.255", "192.168.255.255", true},
+
+		// Link-local / cloud metadata
+		{"169.254.0.1", "169.254.0.1", true},
+		{"169.254.169.254", "169.254.169.254", true},
+
+		// Public IPs (should NOT be blocked)
+		{"8.8.8.8", "8.8.8.8", false},
+		{"1.1.1.1", "1.1.1.1", false},
+		{"93.184.216.34", "93.184.216.34", false},
+
+		// IPv6 loopback
+		{"::1", "::1", true},
+
+		// IPv6 unique local
+		{"fd00::1", "fd00::1", true},
+		{"fc00::1", "fc00::1", true},
+
+		// IPv6 link-local
+		{"fe80::1", "fe80::1", true},
+
+		// IPv6 public (should NOT be blocked)
+		{"2607:f8b0:4004:800::200e", "2607:f8b0:4004:800::200e", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			ip := net.ParseIP(tt.ip)
+			require.NotNil(t, ip, "failed to parse IP %s", tt.ip)
+			assert.Equal(t, tt.blocked, isBlockedIP(ip),
+				"isBlockedIP(%s) = %v, want %v", tt.ip, isBlockedIP(ip), tt.blocked)
+		})
+	}
+}
+
+func TestValidateTargetURL_Blocked(t *testing.T) {
+	t.Parallel()
+
+	blockedURLs := []string{
+		"http://127.0.0.1/hook",
+		"http://127.0.0.1:8080/hook",
+		"https://10.0.0.1/hook",
+		"http://192.168.1.1/webhook",
+		"http://172.16.0.1/api",
+		"http://169.254.169.254/latest/meta-data/",
+		"http://[::1]/hook",
+		"http://[fc00::1]/hook",
+		"http://[fe80::1]/hook",
+		"http://0.0.0.0/hook",
+	}
+
+	for _, u := range blockedURLs {
+		t.Run(u, func(t *testing.T) {
+			t.Parallel()
+			err := ValidateTargetURL(u)
+			assert.Error(t, err, "URL %s should be blocked", u)
+		})
+	}
+}
+
+func TestValidateTargetURL_Allowed(t *testing.T) {
+	t.Parallel()
+
+	// These are public IPs and should be allowed
+	allowedURLs := []string{
+		"https://example.com/hook",
+		"http://93.184.216.34/webhook",
+		"https://hooks.slack.com/services/T00/B00/xxx",
+	}
+
+	for _, u := range allowedURLs {
+		t.Run(u, func(t *testing.T) {
+			t.Parallel()
+			err := ValidateTargetURL(u)
+			assert.NoError(t, err, "URL %s should be allowed", u)
+		})
+	}
+}
+
+func TestValidateTargetURL_InvalidScheme(t *testing.T) {
+	t.Parallel()
+	err := ValidateTargetURL("ftp://example.com/hook")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "unsupported URL scheme")
+}
+
+func TestValidateTargetURL_EmptyHost(t *testing.T) {
+	t.Parallel()
+	err := ValidateTargetURL("http:///path")
+	assert.Error(t, err)
+}
+
+func TestValidateTargetURL_InvalidURL(t *testing.T) {
+	t.Parallel()
+	err := ValidateTargetURL("://invalid")
+	assert.Error(t, err)
+}
+
+func TestBlockedNetworks_Initialized(t *testing.T) {
+	t.Parallel()
+	assert.NotEmpty(t, blockedNetworks, "blockedNetworks should be initialized")
+	// Should have at least the main RFC 1918 + loopback + link-local ranges
+	assert.GreaterOrEqual(t, len(blockedNetworks), 8,
+		"should have at least 8 blocked network ranges")
+}