Keep server data in an encrypted database, and harden every part

Storage. The server keeps its data in SQLite (a file in the data
directory, the default) or PostgreSQL (database, KEEPORG_DATABASE_URL or
-database). Every row, the KDBX versions included, is sealed with
AES-256-GCM under a key derived from the master key and named by an HMAC.
The master key is required to start and a different one is refused. A data
directory from 0.10 or earlier is imported on first start. Several servers
may share one PostgreSQL database. Go goes to 1.26 for the pure-Go
drivers (modernc.org/sqlite, jackc/pgx).

Hardening, after an audit of the server, both clients and the deployment:
- Single sign-on approves a device only after an explicit Approve in the
  browser that started it, bound by a cookie and PKCE; identities are never
  linked by username, by verified email only when allowed, never to admins.
- Sign-in attempts are limited per address and per account, passwords are
  checked outside the store lock with uniform timing, one-time codes work
  once, and starting two-factor needs the password.
- Merge vaults bound KDF parameters, payload size and XML shape, check
  pushes before storing them, and run at most two merges at once. A version
  is written in the same transaction as its metadata.
- Tokens in URLs only on the event stream, which ends on revocation; CSP,
  frame-ancestors, no-store and HSTS; sign-in CSRF; 404 for databases
  without access; new trusted_proxies.
- Clients open only the server's approval page, keep case-variant and
  retired file names apart, never overwrite a save made during a pull,
  require https except locally, send the stream token in a header, bound
  their reads and escape notifications and terminal output.
- The .deb creates the master key, systemd is sandboxed further, nginx sets
  modern TLS and HSTS, and CI deploys from main only.

Server 0.12.0, desktop 0.6.0, Android 0.4.0 (versionCode 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/PROTOCOL.md

@@ -21,7 +21,7 @@ https, and every form carries a per-session CSRF token.
 | POST | `/api/v1/auth/logout` | – | revokes the calling token |
 | GET | `/api/v1/auth/whoami` | – | the account and its group memberships |
 | POST | `/api/v1/auth/password` | `{current_password, new_password, totp}` | changes the account password; the current one is required, and the second factor when enrolled. Every other session of that account is revoked |
-| POST | `/api/v1/auth/totp/enroll` | `{password, totp}`, only when a factor is already on | `{secret, uri}`; not active until confirmed. Replacing an active factor without the password and current code is `403 reauth_required` |
+| POST | `/api/v1/auth/totp/enroll` | `{password, totp}`; `totp` only when a factor is already on | `{secret, uri}`; not active until confirmed. Without the password, `403 reauth_required`; replacing an active factor needs its current code too |
 | POST | `/api/v1/auth/totp/confirm` | `{code}` | `{totp_enabled: true}` |
 | DELETE | `/api/v1/auth/totp` | `{password, totp}` | `{totp_enabled: false}`; `403 reauth_required`, `403 bad_credentials`, `403 totp_invalid` |
 | GET | `/api/v1/auth/sessions` | – | `{sessions: [{id, label, browser, current, created_at, last_seen_at, expires_at}]}`, the caller's own |
@@ -32,6 +32,18 @@ https, and every form carries a per-session CSRF token.
 
 A device code is single use: the first successful poll consumes it.
 
+Sign-in attempts are limited per client address and per account. Over the
+limit, `/auth/login`, `/auth/device/start` and the re-authenticating
+endpoints answer `429 throttled` with `Retry-After`. A one-time code is
+accepted once; a second use is `totp_invalid`. Device labels are trimmed to
+64 characters.
+
+Endpoints about a database answer `404 not_found` both for one that does not
+exist and for one the caller has no access to. A push to a merge vault whose
+KDBX header is malformed or demands more key derivation work than the server
+opens (`internal/kdbx/limits.go`) is `400 invalid_kdbx`. A merge that cannot
+get a turn within 30 seconds is `503 busy`.
+
 A session `id` is a one-way digest of its token, never the token itself, so
 a list of sessions cannot be used to sign in as any of them. Failed
 re-authentication answers `403`, not `401`, so a client that drops its
@@ -54,7 +66,7 @@ retry without it.
 | GET | `/api/v1/databases` | `{databases: [{id, name, perm, merge_strategy, version, sha256, size, updated_at, updated_by}]}` |
 | GET | `/api/v1/databases/{id}/blob` | bytes; `ETag: "<version>"`, `X-KeepOrg-SHA256`; `204` when the database has no content yet; `?version=<n>` reads a stored older version |
 | PUT | `/api/v1/databases/{id}/blob` | body is the KDBX file. `If-Match` is required |
-| GET | `/api/v1/events` | SSE. Accepts `?access_token=` because an event stream cannot always set headers |
+| GET | `/api/v1/events` | SSE, with the `Authorization` header like everything else. `?access_token=` is still accepted here, and only here, for clients before 0.12; it puts the token in proxy logs. The stream ends once the session is revoked or the account disabled |
 
 ### PUT semantics