유창욱 d0ba621b42 fix(cloud): verify login CSRF + zone ownership 400 not 500 (P4-8, P4-6) ... P4-8: AuthController::login now verifies the CSRF token the login form already emits (Csrf::check over session vs posted field), returning 403 before the user lookup. Closes a login-CSRF / session-fixation hole where a forged cross-site POST could silently log a victim into an attacker's account. Tests seed the session+body token; adds testLoginRejectsMissingOrWrongCsrf. P4-6: ZoneConfigController::save wraps the repository write in try/catch(\RuntimeException) so an ownership/device mismatch is a 400 (invalid_zone) client error, not an uncaught 500. Adds testSaveOwnershipMismatchIs400NotError with a throwing repo double. phpunit: 88 passing (4 skipped: PDO-backed). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019Xmn8KZWqiQUguEMRtn6rW		2026-07-17 10:00:04 +09:00
..
superpowers	docs: P1 pilot integration plan (wire edge daemon + CPU pose + detail view)	2026-07-12 10:35:21 +09:00
delivery-audit.md	fix(cloud): verify login CSRF + zone ownership 400 not 500 (P4-8, P4-6)	2026-07-17 10:00:04 +09:00
hardware-bringup.md	feat(edge): hardware adapter stubs + Pi bring-up/benchmark doc	2026-07-11 21:54:24 +09:00
pilot-runbook.md	docs: pilot runbook + gated MoveNet smoke test	2026-07-12 11:49:07 +09:00