Feat/tier3 config and endpoints

.env.example

@@ -66,3 +66,91 @@ CREDENTIAL_STUFFING_COOLDOWN_MINUTES=
 REDIS_URL=
 RATE_LIMIT_ATTEMPTS=
 RATE_LIMIT_WINDOW_SECONDS=
+
+# Password hashing. bcrypt is the engine's default; argon2id is the
+# current recommendation for new deployments (memory-hard, and the knob a
+# GPU attacker cannot parallelize around). Switching is safe at any time
+# and needs no migration — existing bcrypt hashes keep verifying and are
+# rewritten one successful login at a time, which is what
+# GET /v1/admin/security/hash-migration reports on.
+#
+# The ARGON2ID_* vars default to RFC 9106's second recommended option
+# (64 MiB, t=3, p=4) and only need setting to tune them to your hardware.
+# Raise ARGON2ID_MEMORY_KIB before ARGON2ID_ITERATIONS if you have
+# headroom: memory hardness is the whole reason to pick Argon2id. Note
+# that each var replaces exactly one field — leaving the rest at cryden's
+# defaults, never at zero.
+PASSWORD_HASHER=
+ARGON2ID_MEMORY_KIB=
+ARGON2ID_ITERATIONS=
+ARGON2ID_PARALLELISM=
+ARGON2ID_SALT_LENGTH=
+ARGON2ID_KEY_LENGTH=
+
+# The non-secret label every generated API key starts with ("ck_9f3a1c02…").
+# Set it to something recognisable as yours so a key leaked into a commit
+# is greppable by your own secret scanners.
+API_KEY_PREFIX=
+
+# Cloud logging — a second, redacted, filtered copy of the engine's log
+# records, alongside the full-detail JSON line on stdout. Off unless
+# CLOUD_LOGGING is set. LOG_LEVEL is the threshold the shipped copy
+# drops below and must be debug/info/warn/error: an unrecognized value is
+# a startup failure rather than a silent fallback, because defaulting a
+# typo to debug multiplies a vendor bill and defaulting it to error
+# throws away the records you were trying to keep.
+#
+# There is no vendor here — this repo ships no SDK, so the shipped copy
+# is recorded in the shipped_log_events table, which
+# GET /v1/admin/logging/recent (admin) reads back. It is the same bytes a
+# hosted aggregator would have received, which is what makes it a stand-in
+# for one rather than a second, different log beside it.
+#
+# CLOUD_LOG_REDACTION is "mask" (value replaced with [redacted]) or
+# "hash" (keyed HMAC digest, so the same address still reads as the same
+# address across records — "one IP, forty accounts" is the shape
+# credential stuffing has, and a mask destroys it). "hash" requires
+# CLOUD_LOG_HASH_KEY, which must be identical on every replica and should
+# be a value of its own rather than a reuse of JWT_SECRET.
+CLOUD_LOGGING=
+LOG_LEVEL=
+CLOUD_LOG_REDACTION=
+CLOUD_LOG_HASH_KEY=
+
+# A directory holding message templates, rendered instead of the console
+# senders' built-in lines. Optional — unset keeps today's behaviour.
+# Recognised files are verification.txt and magic_link.txt; supply either
+# or both. Available fields: {{.To}}, {{.Token}}, {{.URL}} (empty for a
+# verification message, and for a magic link when BASE_URL is unset).
+# A directory that is set but holds neither file, or a file that does not
+# parse, is a startup failure — a template directory that silently did
+# nothing is worse than one that refused to start.
+EMAIL_TEMPLATE_DIR=
+
+# Webhook deliveries. WEBHOOK_URL is the on/off switch: leave it unset and
+# the engine dispatches nothing, no delivery worker runs, and
+# GET /v1/admin/webhooks/deliveries answers 404 not_configured. The other
+# three are only read when it is set, and setting any of them without it
+# is a startup failure rather than a setting that silently does nothing.
+#
+# Events are queued in the webhook_deliveries table and delivered by a
+# background worker, never inline: cryden calls the sender on the login
+# request path, so an HTTP call there would be your receiver's downtime
+# becoming your users' login latency. A delivery is retried with
+# exponential backoff (30s doubling to 30m) until WEBHOOK_MAX_ATTEMPTS is
+# spent, then recorded as failed and left readable — retrying forever is a
+# load generator pointed at someone else's server.
+#
+# Each request carries X-Cryden-Signature: "sha256=" plus the lowercase
+# hex HMAC-SHA256 of the raw body under WEBHOOK_SECRET. Unset means
+# deliveries go out unsigned and the header is absent entirely; a receiver
+# on a private network is a legitimate reason to do that, and a signature
+# over an empty key is not.
+#
+# WEBHOOK_EVENTS is a comma-separated list of audit event types. Unset
+# uses cryden's own default set, which deliberately excludes
+# login_success, login_failed and token_rotated.
+WEBHOOK_URL=
+WEBHOOK_SECRET=
+WEBHOOK_EVENTS=
+WEBHOOK_MAX_ATTEMPTS=