security: harden /upload, /new_module, /heartbeat against anonymous abuse (closes #228, closes #229)

[cofade]

Summary

Both internet-reachable, credential-free trust boundaries flagged by the 2026-08-18 repo audit (epic #262) had no bounds beyond "accepts the request":

• image-service /upload (addresses security: validate upload content — JPEG magic + dimension guard + forced .jpg + explicit image/jpeg on serve (stored-HTML, decompression bomb, sidecar leak) #228). Never inspected upload bytes — a stored .html/.svg could be served back same-origin with a sniffed Content-Type (same origin as the admin session cookie), and a crafted JPEG could decompression-bomb the single-process service before any decoder ran. Fixed by services/image_guard.py::probe_jpeg — a header-only JPEG magic-byte + dimension check, never a pixel decode — running before anything is saved or handed to cv2.imread. The stored extension is now always forced to .jpg, and GET /images/GET /snips (image-service + backend proxies) pin Content-Type: image/jpeg instead of guessing from the extension, which also closes an unrelated .log.json telemetry-sidecar-reachability gap.
• duckdb-service /new_module + /heartbeat (addresses security: harden the internet-proxied /new_module and /heartbeat writes (no-overwrite on re-registration, unknown-MAC drop, clamps, nginx limits, no raw-body logging) + device-identity ADR #229). Any anonymous re-POST to /new_module could overwrite a placed module's name/email/location (public-map defacement) and spammed the Discord webhook on every call; /heartbeat let an unregistered MAC grow module_heartbeats without bound. Fixed by preserving identity fields on re-registration unless unset, firing Discord only on first insert, dropping heartbeats for unknown MACs (still 200, nothing written), clamping battery instead of storing it unbounded, and removing two log lines that leaked the raw pre-validation body (including operator email) and sub-2dp-precision coordinates into the admin-readable, disk-persisted log ring.

Also ships, deliberately as documentation/template rather than code: ADR-032 records the device-identity decision (an interim compiled-in fleet key) for a separate follow-up issue, and deploy/nginx/highfive-ingest.conf is a syntax-verified (nginx -t via Docker) rate/body-size-limit template for an operator to apply to the live host — not yet deployed there.

Review history

This branch went through three independent rounds of the mandated senior-reviewer gate:

• Round 1 found a real P0: the first-pass lat/lng UPSERT guard in add_module inverted its own gating condition and still let an anonymous re-POST relocate a placed module — verified end-to-end (one POST moved a module from Germany to Sydney).
• Round 2 re-verified the P0 fix across 11 scenarios (including the pre-existing PR-II/esp: getGeolocation race on first boot — module appears at Null Island until manual RST #89 recovery path, to confirm no regression) and found a real functional bug: OPENCV_IO_MAX_IMAGE_PIXELS was hardcoded separately from MAX_IMAGE_DIM, so the troubleshooting doc's own advice to raise the latter would have silently broken hole detection. Both fixed and verified (the OpenCV fix via a subprocess test, since the protection is native-library state that a same-process module reload can't exercise).
• Round 3 was a documentation-drift sweep — a couple of docs/comments still described the pre-fix behaviour after the code changed. Fixed, plus a tree-wide grep sweep (not just docs/) to confirm no stale copies remained.

Full write-ups of both incidents (the CASE inversion and the drift pattern) are in docs/11-risks-and-technical-debt/README.md.

Test plan

All run locally, all green:

• cd image-service; py -m pytest tests/ -q — 181 passed
• cd duckdb-service; py -m pytest tests/ -q — 304 passed
• cd backend; npm test — 296 passed
• py -m pytest tests/e2e/ -v (real docker compose stack) — 6/6 passed
• Playwright UI suite (docker compose -f tests/ui/docker-compose.ui.yml ... ; npx playwright test) — 16/16 passed (1 pre-existing, unrelated skip)
• make check-citations and all other pre-push guard scripts — clean
• nginx -t against the merged deploy/nginx/highfive-ingest.conf + site config (Docker, nginx:alpine) — syntax valid

🤖 Generated with Claude Code