security: hash registration tokens at rest, idempotency guard, README trust model

SEC-001: Registration tokens stored as SHA-256 hashes. Migration 046 adds
token_hash column, backfills from plaintext, drops token column. All queries
use hash. Token plaintext shown once at creation (reveal panel in UI), never
retrievable again. Follows the refresh-token pattern.

SEC-005: README "no sanitization" claims corrected — code correctly sanitizes
against log injection (ANSI stripping, control char replacement, truncation).
Wording updated to match reality.

SEC-008: Command creation with idempotency_key uses ON CONFLICT DO NOTHING
instead of blind insert. Prevents duplicate command execution.

Trust model: Ed25519 key rotation documented — signing_keys table supports
multiple concurrent active keys with a sliding window for zero-downtime
rotation. OSV.dev ecosystem coverage updated (apt, dnf added).

README.md

@@ -84,13 +84,13 @@ Agents run at the OS level and query the Docker socket directly — there's no s
 
 Agents register with a one-time token plus a hardware fingerprint. The server stores the fingerprint; future check-ins that don't match the registered machine are rejected. This prevents config copying between hosts.
 
-On first connect, the agent fetches and caches the server's Ed25519 public key (TOFU). Every subsequent command is verified against it. Keys have TTL-based rotation — agents pre-cache new keys before the old ones expire, so rotation is zero-downtime.
+On first connect, the agent fetches and caches the server's Ed25519 public key (TOFU). Every subsequent command is verified against it. The `signing_keys` table supports multiple concurrent active keys with a sliding window — a new key is promoted to primary while the old key remains active, so agents that cached the previous key continue verifying successfully until the operator deactivates it. Rotation is zero-downtime; no coordinated restart required.
 
 Every command includes a signed nonce with a 10-minute validity window. The agent tracks executed nonces and rejects replays, including from an attacker who intercepted a valid command.
 
 Agent-server communication runs over HTTPS. The Ed25519 signing model is a defense-in-depth layer on top of that — commands can't be forged or replayed even if traffic is somehow intercepted or TLS is terminated at a proxy. The signing model doesn't assume the transport is trustworthy. Cert pinning and enforced TLS verification are on the roadmap.
 
-Before a package is installed: the agent fetches the expected SHA-256 from the server, downloads the artifact, verifies the hash. Mismatch blocks the install. At approval time, OSV.dev is queried for known vulnerabilities in npm and PyPI packages.
+Before a package is installed: the agent fetches the expected SHA-256 from the server, downloads the artifact, verifies the hash. Mismatch blocks the install. OSV.dev is queried for known vulnerabilities at discovery time (async, deduped) for npm, PyPI, apt, and dnf packages — results are visible in the dashboard before approval.
 
 **Refresh-token rotation.** Each renewal mints a new refresh token and marks the old one consumed. Replaying a consumed token whose successor was also consumed means theft — the server revokes the entire token family and logs a security event. Agent crash-before-save is covered by accept-previous-once grace: a consumed token whose successor is still unconsumed gets a fresh one, not a revocation.
 
@@ -135,7 +135,7 @@ Before a package is installed: the agent fetches the expected SHA-256 from the s
 - **Idempotent installer** — re-running won't create duplicate agents
 - **Proxy support** — HTTP/HTTPS/SOCKS5 for restricted networks
 - **Native services** — systemd on Linux, Windows Services on Windows
-- **Full audit trail** — all operations logged with context, nothing sanitized
+- **Full audit trail** — all operations logged with context, sanitized against log injection
 
 ---
 
@@ -207,11 +207,11 @@ Then install fresh with the standard one-liner.
 RedFlag follows ETHOS:
 
 - **Honest** — what you see is what you get
-- **Transparent** — errors logged with full context, nothing sanitized
+- **Transparent** — errors logged with full context, sanitized against injection
 - **Secure** — hardware binding, cryptographic verification, local-only logging
 - **Open standards** — no vendor lock-in, no cloud dependency, no telemetry
 
-The maintainer runs this on their own infrastructure. Releases are versioned, migrations are idempotent. If something breaks, the error shows up in full — not sanitized into a generic failure message.
+The maintainer runs this on their own infrastructure. Releases are versioned, migrations are idempotent. If something breaks, the error shows up in full — not swallowed into a generic failure message. Log output is sanitized against injection (ANSI stripping, control character replacement, field truncation) but the content is preserved.
 
 Built for operators who'd rather own the problem than outsource it.