Harden protocol, authentication, and session lifecycle

[krotname]

Summary

• bound and strictly validate UTF-8 protocol frames, handshake deadlines, message metadata, and client/server lifecycle state
• harden authentication, TLS, storage paths, atomic history persistence, legacy account migration, and server concurrency cleanup
• fix GUI deduplication/export edge cases and make release SBOM/provenance tasks Gradle 10 compatible
• expand unit, integration, concurrency, security, and UI coverage

Validation

• clean check jacocoAllReport releaseBundle --offline --no-daemon --warning-mode all
• 92 tests, 0 failures or skips
• JaCoCo: 80.61% lines, 66.88% branches
• Checkstyle, Spotless, SpotBugs (main/test/integration/UI), release bundle: passed

Compatibility

• newly generated account rows use an explicit pbkdf2-sha256$210000$ marker
• canonical legacy SHA-256 rows remain usable for migration and should be rotated with createAccount

[sonarqubecloud]

Quality Gate passed

Issues
23 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d510a2d74e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Avoid broadcasting while holding the session lock

When a user disconnects while any remaining client is slow or not reading, this broadcast(...) can block indefinitely in ChatConnection.send() while sessionsMonitor is still held. That lock is also needed by new handshakes before adding a session, so one stuck USER_REMOVED delivery can stall other users from logging in or being cleaned up; copy the recipients under the lock, then close/broadcast outside it.

Useful? React with 👍 / 👎.