security: harden first preview boundaries

Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

auth/auth.go

@@ -192,6 +192,9 @@ func (service *Service) Session(ctx context.Context, token string) (Principal, e
 }
 
 func (service *Service) RevokeSession(ctx context.Context, token string) error {
+	if len(token) < 32 || len(token) > 128 {
+		return ErrSessionNotFound
+	}
 	digest := sha256.Sum256([]byte(token))
 	return service.repository.DeleteSession(ctx, digest)
 }