audit 4: sign-in timing and sessions, server timeouts, polling that recovers

Steps 1-3 of stage 4, tested together (their docs share files).

Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.

Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).

Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).

Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/auth/handlers.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+	"sync"
 
 	"github.com/mixeme/selfpost/internal/store"
 	"github.com/mixeme/selfpost/internal/web/validate"
@@ -117,6 +118,10 @@ func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
 		if !errors.Is(err, store.ErrUserNotFound) {
 			logf("panel: login: get user failed: %v", err)
 		}
+		// A comparison anyway, so an unknown name is refused in the time
+		// a wrong password is: the answer's delay told which names exist
+		// (audit 2026-10-12, M8).
+		_ = bcrypt.CompareHashAndPassword(noSuchUserHash(), []byte(password))
 		m.renderLogin(w, http.StatusUnauthorized, "Invalid username or password.")
 		return
 	}
@@ -126,6 +131,15 @@ func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// The session the browser presents, if any, ends here: a sign-in issues
+	// a new token and leaves no other behind it - one planted before the
+	// sign-in is worth nothing after (audit 2026-10-12, L16).
+	name := m.sessionCookie()
+	for _, c := range r.Cookies() {
+		if c.Name == name {
+			m.sessions.Destroy(c.Value)
+		}
+	}
 	token, err := m.sessions.Create(user.ID)
 	if err != nil {
 		logf("panel: login: create session failed: %v", err)
@@ -136,6 +150,16 @@ func (m *Module) submitLogin(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusSeeOther)
 }
 
+// noSuchUserHash is a hash of the panel's work factor, compared against when
+// a sign-in names no user.
+var noSuchUserHash = sync.OnceValue(func() []byte {
+	h, err := bcrypt.GenerateFromPassword([]byte("selfpost: no such user"), BcryptCost)
+	if err != nil {
+		panic(err)
+	}
+	return h
+})
+
 // setSessionCookie sets the session cookie. SameSite=Lax withholds it from a
 // cross-site request unless that is a top-level navigation with a safe method
 // (rfc6265bis § 5.8.3, § 5.6.7.1), so a cross-site POST arrives without it.