fix: security hardening from CSO audit

- Add auth failure logging (login, API key, JWT) with IP/email/prefix
- Move OAuth JWT from URL params to short-lived cookies to prevent
  token leakage via browser history, server logs, and Referer headers
- Pin Swagger UI to v5.18.2 with SRI integrity hashes
- Upgrade Go toolchain to 1.25.8 (fixes 5 called stdlib vulns)
- Fix unchecked error in host agent credential refresh
- Add .gstack to .gitignore for security report artifacts

internal/api/handlers_auth.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	"errors"
+	"log/slog"
 	"net/http"
 	"strings"
 
@@ -202,6 +203,7 @@ func (h *authHandler) Login(w http.ResponseWriter, r *http.Request) {
 	user, err := h.db.GetUserByEmail(ctx, req.Email)
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
+			slog.Warn("login failed: unknown email", "email", req.Email, "ip", r.RemoteAddr)
 			writeError(w, http.StatusUnauthorized, "unauthorized", "invalid email or password")
 			return
 		}
@@ -210,10 +212,12 @@ func (h *authHandler) Login(w http.ResponseWriter, r *http.Request) {
 	}
 
 	if !user.PasswordHash.Valid {
+		slog.Warn("login failed: no password set", "email", req.Email, "ip", r.RemoteAddr)
 		writeError(w, http.StatusUnauthorized, "unauthorized", "invalid email or password")
 		return
 	}
 	if err := auth.CheckPassword(user.PasswordHash.String, req.Password); err != nil {
+		slog.Warn("login failed: wrong password", "email", req.Email, "ip", r.RemoteAddr)
 		writeError(w, http.StatusUnauthorized, "unauthorized", "invalid email or password")
 		return
 	}