fix: security hardening from CSO audit

- Add auth failure logging (login, API key, JWT) with IP/email/prefix
- Move OAuth JWT from URL params to short-lived cookies to prevent
  token leakage via browser history, server logs, and Referer headers
- Pin Swagger UI to v5.18.2 with SRI integrity hashes
- Upgrade Go toolchain to 1.25.8 (fixes 5 called stdlib vulns)
- Fix unchecked error in host agent credential refresh
- Add .gstack to .gitignore for security report artifacts

internal/api/middleware_auth.go

@@ -20,6 +20,7 @@ func requireAPIKeyOrJWT(queries *db.Queries, jwtSecret []byte) func(http.Handler
 				hash := auth.HashAPIKey(key)
 				row, err := queries.GetAPIKeyByHash(r.Context(), hash)
 				if err != nil {
+					slog.Warn("api key auth failed", "prefix", auth.APIKeyPrefix(key), "ip", r.RemoteAddr)
 					writeError(w, http.StatusUnauthorized, "unauthorized", "invalid API key")
 					return
 				}
@@ -42,6 +43,7 @@ func requireAPIKeyOrJWT(queries *db.Queries, jwtSecret []byte) func(http.Handler
 				tokenStr := strings.TrimPrefix(header, "Bearer ")
 				claims, err := auth.VerifyJWT(jwtSecret, tokenStr)
 				if err != nil {
+					slog.Warn("jwt auth failed", "error", err, "ip", r.RemoteAddr)
 					writeError(w, http.StatusUnauthorized, "unauthorized", "invalid or expired token")
 					return
 				}