Remove Hardcoded OAuth Secret, Enforce JWT Secret Validation, and Add Challenge Expiry/Rate Limiting

[mertcano]

Description

This pull request addresses critical and high-severity security vulnerabilities identified in task-master during the Quantus workspace security audit (FM-01, FM-02, FM-03)[cite: 54].

A live X (Twitter) OAuth client secret was previously committed in plaintext within default.toml, creating an immediate credential exposure risk[cite: 54]. Additionally, the server could start using committed placeholder JWT secrets, allowing arbitrary token forgery[cite: 54]. Furthermore, the unauthenticated request-challenge endpoint was susceptible to unbounded memory growth (DoS) and authentication replay attacks due to missing TTLs and capacity bounds[cite: 54].

Key Changes & Remediations

1. OAuth Secret Redaction (FM-01 - config/default.toml)

• Redacted Credentials: Replaced the committed live X OAuth credentials with explicit "replace-me" placeholders[cite: 54, 55].
• Operator Documentation: Added explicit security comments requiring credentials to be injected via environment-specific configuration[cite: 55]. (Note: Maintainers must rotate the compromised secret with X and purge historical git references)[cite: 54].

2. Fail-Fast JWT Secret Validation (FM-02 - src/config.rs)

• Placeholder Detection: Added validate() to Config::load(), checking whether jwt.secret or jwt.admin_secret equals "this-should-be-overriden"[cite: 54, 56].
• Server Boot Refusal: Halts process startup with an actionable ConfigError instructing operators to set TASKMASTER_JWT__SECRET and TASKMASTER_JWT__ADMIN_SECRET rather than running with known signing keys[cite: 54, 56].

3. Challenge Memory Capping & Replay Protection (FM-03 - src/handlers/auth.rs, src/http_server.rs)

• TTL & Capacity Limits: Defined Challenge::TTL_SECONDS = 300 and Challenge::MAX_PENDING = 10_000[cite: 54, 58].
• Eviction & Back-Pressure: In request_challenge, expired entries are pruned via retain()[cite: 54, 57]. If pending challenges still exceed MAX_PENDING, the handler responds with StatusCode::TOO_MANY_REQUESTS[cite: 54, 57].
• Replay Mitigation: verify_login validates expiration via is_expired(Utc::now()) and removes consumed or expired challenges from the store[cite: 54, 57].

How to Review

1. Inspect config/default.toml to verify that no live credentials remain[cite: 55].
2. Review src/config.rs to confirm Config::validate() properly errors out when default JWT placeholders are used[cite: 56].
3. Inspect src/handlers/auth.rs and src/http_server.rs to verify challenge eviction logic, the MAX_PENDING check, and single-use replay deletion[cite: 57, 58].