Fix telemetry provenance, add secrets/exploit traps, budget slow responses

[ShaneMain]

Why

Six weeks of captures showed the dashboard was mostly measuring things that were not attacker behaviour, and that the busiest attacker objective had no trap at all.

Telemetry correctness (migration 004)

	before	after
"credentials captured"	730	175
events counted as attacker traffic	3828	1465
cf_ipcountry populated	0 rows	forwarded from request.cf

• synthetic flags backfilled rows — 56% of the table, no POST bodies, inferred IPs in the drop-recovery case.
• planted_user/planted_pass separate honeytokens we serve from credentials attackers send. The .env trap wrote plants into submitted_*.
• honeypot_event_live excludes Cloudflare-origin traffic, which was the top "attacker" path (a 2-hour cadence from CF's own ranges).
• The xmlrpc parser captured post titles as usernames on publishing calls.

New traps

Secrets harvesting was ~46% of real traffic and answered 404. Now trapped: .aws/credentials (optional real AWS canary token), .git-credentials, .gitconfig, .gitlab-ci.yml, .github/workflows, .npmrc, .docker/config.json, fake phpinfo(), Spring Boot Actuator + slow heapdump, admin-ajax.php and plugin PHP endpoints, wp-json/batch/v1, phpMyAdmin across 15 spellings, and an XML-RPC content-injection canary.

The canary is served only to the injecting IP, noindex and escaped — attacker content reachable by anyone else would make this a spam relay.

Credibility

Responses now carry PHP/WordPress headers via middleware and the Worker strips server: Google Frontend. Core JS/CSS is served; 404ing jquery.js identified the install as fake.

Resource safety

• Shared slow-response budget bounds concurrent held responses; over budget, traps answer immediately and log a delay of 0 so response_delay_ms stays truthful.
• Body limits were inert — set on empty Routers before routes were added, so axum never wrapped them. A 100 KB POST to /wp-login.php returned 200; now 413.
• Batch amplification capped at 25. One 141 KB request wrote 2000 rows, 8 MB of duplicated body text, and held a pool connection for 38s. Now 25 rows, 4 KB, 0.48s.
• The unbudgeted heapdump path buffered the full dump at peak concurrency — the fallback was the memory-hungry branch on a 256 MiB container.
• admin-ajax only registers instant-grant pairs for real privilege escalation; any pair used to qualify, which was a two-request oracle for identifying the honeypot.
• Planted AWS keys and phpass hashes no longer share a constant tail across every IP.

Verification

fmt --check clean, clippy --all-targets -D warnings clean, 117 tests (from 56). All four migrations applied to a throwaway Postgres and every trap exercised end-to-end, including the full kit chain: escalation → instant-grant verification login → 302.

https://claude.ai/code/session_01MSq1R1A6xQ9dk1CzBVf6Xk