audit 4: sign-in timing and sessions, server timeouts, polling that recovers

Steps 1-3 of stage 4, tested together (their docs share files).

Step 1 (M8, L15, L16): an unknown name pays a bcrypt comparison at the
panel's work factor too (noSuchUserHash, made once) -
TestLoginTakesAsLongForAnUnknownName holds the medians within a factor of
two; the Account form's current-password check has its own limiter, per
user (AllowPasswordChange); a sign-in destroys every session the request
presents before it issues its own.

Step 2 (L14): newHTTPServer - ReadTimeout 30 s, WriteTimeout 60 s,
IdleTimeout 2 min beside ReadHeaderTimeout; the full backup moves its write
deadline to two hours through http.ResponseController (e2e: the log shows
no failure to move it).

Step 3 (M11), read in htmx 2.0.4's source (dev/upstream/htmx-2.0.4, the npm
build byte-equal to the shipped htmx.min.js): the poll passes source: box,
and the next refresh is scheduled from htmx:afterRequest, which htmx fires
on load, error, abort and timeout, and after a swap on the nearest parent
left (the box found by detail.target's id); failures in a row double the
wait to 60 s. RequireAuth answers htmx with 401 + HX-Redirect: /login,
which htmx follows before it looks at the status. testdata/poll_test.js
runs panel.js in node against a stand-in DOM and clock (TestPanelJS; skipped
without node, which the test server lacks - run here, and it fails on the
old panel.js).

Also measured: the stage-3 e2e regression for H1 fails as it should on HEAD
with the old entrypoint ("check data/postfix/e2e_extra_map: permission
denied", the panel restarting).

Tested on the test server: go vet + go test of 25 packages, make e2e (all
pass, 639 s) on this tree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/web/handlers/handlers_account.go

@@ -141,7 +141,7 @@ func (h *Handlers) HandleAccountPassword(w http.ResponseWriter, r *http.Request)
 		f.Err = msg
 		h.renderAccount(w, r, status, u, f)
 	}
-	if !h.auth.AllowLoginAttempt(r) {
+	if !h.auth.AllowPasswordChange(u.ID) {
 		fail(http.StatusTooManyRequests, "Too many attempts. Please wait and try again.")
 		return
 	}

internal/web/handlers/handlers_account_test.go

@@ -2,6 +2,7 @@ package handlers
 
 import (
 	"net/http"
+	"net/http/httptest"
 	"net/url"
 	"strings"
 	"testing"
@@ -197,3 +198,29 @@ func TestAccountPageForADomainAdministrator(t *testing.T) {
 		}
 	}
 }
+
+// The Account form's current-password check has its own bucket, per user:
+// it stops a guesser at ten, and does not lock the address out of signing in
+// (audit 2026-10-12, L15).
+func TestAccountPasswordGuessesHaveTheirOwnLimit(t *testing.T) {
+	h, _ := settingsServer(t)
+	wrong := url.Values{"current_password": {"nope"}, "new_password": {"another-long-password-2"}, "new_password_confirm": {"another-long-password-2"}}
+	for i := 0; i < 10; i++ {
+		if rec := postFormAs(h.HandleAccountPassword, globalPrincipal, "/account/password", nil, wrong); rec.Code != http.StatusUnauthorized {
+			t.Fatalf("guess %d = %d, want 401", i+1, rec.Code)
+		}
+	}
+	if rec := postFormAs(h.HandleAccountPassword, globalPrincipal, "/account/password", nil, wrong); rec.Code != http.StatusTooManyRequests {
+		t.Fatalf("the eleventh guess = %d, want 429", rec.Code)
+	}
+
+	// The same address may still sign in: postFormAs and this request come
+	// from httptest's one RemoteAddr.
+	req := httptest.NewRequest(http.MethodPost, "/login", strings.NewReader(url.Values{"username": {"x"}, "password": {"y"}}.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	rec := httptest.NewRecorder()
+	h.auth.HandleLogin(rec, req)
+	if rec.Code == http.StatusTooManyRequests {
+		t.Error("the password guesses locked the address out of signing in")
+	}
+}

internal/web/handlers/handlers_backup.go

@@ -107,6 +107,15 @@ func (h *Handlers) HandleBackup(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Disposition", fmt.Sprintf("attachment; filename=%q", filename))
 	w.Header().Set("Cache-Control", "no-store")
 
+	// The server's write deadline is for pages (cmd/panel newHTTPServer); an
+	// archive streams for as long as it takes. Two hours carry a gigabyte at
+	// a little over 1 Mbit/s, and still end a client that keeps the
+	// connection and stops reading, which TCP alone would not (net/http, Go
+	// 1.26: ResponseController.SetWriteDeadline).
+	if err := http.NewResponseController(w).SetWriteDeadline(time.Now().Add(2 * time.Hour)); err != nil {
+		logf("panel: full backup: lift the write deadline: %v", err)
+	}
+
 	// Everything below streams: past this point headers (and possibly some
 	// bytes) are already on the wire, so a failure cannot switch to a clean
 	// error page. Log it and let the truncated download fail loudly on the