fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed

- TWO_FACTOR_ALLOW_LOG_DELIVERY production opt-in REMOVED: plaintext codes are written to the stdout log ([2FA]/[VERIFY]) only in dev/test builds as a local DEV ONLY feature while email/SMS delivery (P6) is implemented. Production builds have no delivery channel and code issuance fails closed (503) under any configuration — no silent log-based code leak
- verification/2FA codes hashed at rest (HMAC-SHA256 via TWO_FACTOR_PEPPER, CHAR(64)); [VERIFY] dev log relay; per-user brute-force budget; password_reset purpose clears lockout for self-service recovery; dummy-bcrypt on login no-user path kills timing oracle
- sabredav weak-password list + entropy gate; .env.example ships fail-closed DAV_ADMIN_PASSWORD
- delete-account re-auth (current_password + fresh 2FA code when enforced)
- prod-tag suite (run-prod-tag-tests.sh) compiles and runs the production 2FA issuance gate: production ALWAYS reports no delivery channel and refuses issuance after the pepper check
- startup_checks_test SNAPSHOT_ENC_KEY values built at runtime so gitleaks sees no secret-shaped literals
- env-docs parity updated (flag removed, 38 vars)

backend/handlers/user/twofa_dev.go

@@ -2,12 +2,13 @@
 
 package user
 
-// Dev/test builds (the `dev` tag, or any build with the `test` tag) keep the
-// documented loose-fake 2FA delivery: the plaintext code is written to the
-// server log ([2FA] prefix) as the stand-in for the not-yet-wired email/SMS
-// transport (P6), and a missing TWO_FACTOR_PEPPER still falls back to the
-// legacy unsalted SHA-256 digest. Production builds (!dev && !test) instead
-// never log the code and fail closed without the pepper — see twofa_prod.go.
+// Dev/test builds (the `dev` tag, or any build with the `test` tag) deliver 2FA
+// codes to the LOCAL DEV stdout log ([2FA] prefix) as the stand-in for the
+// not-yet-wired email/SMS transport (P6), and a missing TWO_FACTOR_PEPPER still
+// falls back to the legacy unsalted SHA-256 digest. Production builds
+// (!dev && !test) instead NEVER log the code — log delivery is a dev/test-only
+// local feature, never a production channel — and fail closed without the
+// pepper — see twofa_prod.go.
 
 import (
 	"crussell/internal/twofa"
@@ -45,10 +46,10 @@ func init() {
 func twoFAEnsureIssueAllowed() error { return nil }
 
 // twoFADeliverCode delivers a fresh verification code to the user. Dev/test:
-// the [2FA] log line is the delivery channel — an operator relays the code to
-// the user out-of-band until email/SMS lands. Production builds log it ONLY
-// when the operator explicitly opts in via TWO_FACTOR_ALLOW_LOG_DELIVERY=true
-// (see twofa_prod.go); otherwise they refuse issuance up front.
+// the [2FA] log line is the LOCAL DEV delivery channel — an operator (or the
+// developer) relays the code to the user out-of-band until email/SMS lands
+// (P6). Production builds NEVER log it (see twofa_prod.go) and refuse issuance
+// up front — stdout-log delivery is a dev/test-only feature.
 //
 // MEDIUM-3b: the user id and the plaintext code are written to SEPARATE log
 // lines so a log line cannot trivially pair a code with its owner. The two