feat(security): fingerprint binding, rate limiting, and miss-spike detection on session handles

Refactor `session_handle.rs` into a module with four focused files:
`fingerprint.rs`, `rate_limit.rs`, `miss_tracker.rs`, and `store.rs`.

The store gains three new capabilities:

- **Fingerprint binding** (`FingerprintMode`: Strict / Subnet / Disabled):
  `SessionHandleStore::create()` captures `(tenant_id, peer IP)` as a
  `ClientFingerprint`; subsequent resolves from a mismatched origin are
  rejected and emit a `SessionHandleFingerprintMismatch` audit event.

- **Per-connection rate limiting**: `resolve()` now takes a `conn_key`
  string; each connection gets a sliding-window counter capped at
  `resolve_attempts_per_window`. Exceeding the cap returns
  `ResolveOutcome::RateLimited`, which the pgwire and HTTP handlers
  convert into a fatal SQLSTATE 53300 error that closes the connection.

- **Miss-spike detection**: consecutive resolve misses on one connection
  within `miss_spike_window_secs` beyond `miss_spike_threshold` emit a
  `SessionHandleResolveMissSpike` audit event.

`SessionHandleStore::resolve()` now returns `ResolveOutcome` (Resolved /
Miss / RateLimited) instead of an `Option`; all call sites updated.

Two new audit events are added (`SessionHandleFingerprintMismatch` = 23,
`SessionHandleResolveMissSpike` = 24) at `AuditLevel::Standard`.

`AuditLog` is moved from `Mutex<AuditLog>` to `Arc<Mutex<AuditLog>>` in
`SharedState` so the session-handle store can hold a clone for its
emission path without calling back into `SharedState`. A
`wire_session_handle_audit` helper wires the audit hook at `new()` and
`from_persistent()` time.

`SessionHandleConfig` is added to `AuthConfig` (serde, defaults: 1h TTL,
Subnet fingerprint mode, 20 resolves / 60 s window, 10-miss / 60 s spike
threshold). `SharedState::from_persistent` constructs the store from
config.

HTTP server uses `into_make_service_with_connect_info` so the
`POST /api/auth/session` route can extract `ConnectInfo<SocketAddr>` for
fingerprint capture. pgwire handlers and `SET nodedb.auth_session` eager
validation both pass `ClientFingerprint` and `conn_key` into resolve.

Author: farhan-syah

nodedb/src/config/auth.rs

@@ -271,6 +271,100 @@ pub struct AuthConfig {
     /// Usage metering configuration.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub metering: Option<crate::control::security::metering::config::MeteringConfig>,
+
+    /// Opaque session handle configuration: fingerprint binding, resolve
+    /// rate-limit, miss-spike detection. Issues #67 and #68.
+    #[serde(default)]
+    pub session: SessionHandleConfig,
+}
+
+/// Configuration for `SessionHandleStore`: fingerprint binding, per-connection
+/// resolve rate limit, miss-spike detection. Maps directly to the acceptance
+/// criteria from issues #67 and #68.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct SessionHandleConfig {
+    /// Session handle TTL in seconds. Default: 3600 (1 hour).
+    #[serde(default = "default_session_ttl_secs")]
+    pub ttl_secs: u64,
+
+    /// Fingerprint-binding strictness. Default: `subnet` (#67).
+    #[serde(default)]
+    pub fingerprint_mode: SessionFingerprintMode,
+
+    /// Per-connection resolve attempts allowed within
+    /// `rate_limit_window_secs`. Exceed → fatal pgwire error + connection
+    /// close. Default: 20 (#68).
+    #[serde(default = "default_session_rate_limit_max")]
+    pub resolve_attempts_per_window: u32,
+
+    /// Sliding-window length for the rate limiter in seconds.
+    /// Default: 60.
+    #[serde(default = "default_session_rate_limit_window_secs")]
+    pub rate_limit_window_secs: u64,
+
+    /// Number of resolve misses on a single connection within
+    /// `miss_spike_window_secs` that triggers a
+    /// `SessionHandleResolveMissSpike` audit event. Default: 10.
+    #[serde(default = "default_session_miss_spike_threshold")]
+    pub miss_spike_threshold: u32,
+
+    /// Sliding-window length for the spike detector in seconds.
+    /// Default: 60.
+    #[serde(default = "default_session_miss_spike_window_secs")]
+    pub miss_spike_window_secs: u64,
+}
+
+/// Serde-facing mirror of
+/// [`crate::control::security::session_handle::FingerprintMode`]. Two
+/// enums exist because the core type lives in the `security` module and
+/// the config module would pull it into the serde surface.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "lowercase")]
+pub enum SessionFingerprintMode {
+    Strict,
+    #[default]
+    Subnet,
+    Disabled,
+}
+
+impl From<SessionFingerprintMode> for crate::control::security::session_handle::FingerprintMode {
+    fn from(m: SessionFingerprintMode) -> Self {
+        use crate::control::security::session_handle::FingerprintMode as Core;
+        match m {
+            SessionFingerprintMode::Strict => Core::Strict,
+            SessionFingerprintMode::Subnet => Core::Subnet,
+            SessionFingerprintMode::Disabled => Core::Disabled,
+        }
+    }
+}
+
+impl Default for SessionHandleConfig {
+    fn default() -> Self {
+        Self {
+            ttl_secs: default_session_ttl_secs(),
+            fingerprint_mode: SessionFingerprintMode::default(),
+            resolve_attempts_per_window: default_session_rate_limit_max(),
+            rate_limit_window_secs: default_session_rate_limit_window_secs(),
+            miss_spike_threshold: default_session_miss_spike_threshold(),
+            miss_spike_window_secs: default_session_miss_spike_window_secs(),
+        }
+    }
+}
+
+fn default_session_ttl_secs() -> u64 {
+    3600
+}
+fn default_session_rate_limit_max() -> u32 {
+    20
+}
+fn default_session_rate_limit_window_secs() -> u64 {
+    60
+}
+fn default_session_miss_spike_threshold() -> u32 {
+    10
+}
+fn default_session_miss_spike_window_secs() -> u64 {
+    60
 }
 
 impl Default for AuthConfig {
@@ -289,6 +383,7 @@ impl Default for AuthConfig {
             jwt: None,
             rate_limit: None,
             metering: None,
+            session: SessionHandleConfig::default(),
         }
     }
 }

nodedb/src/control/security/audit/event.rs

@@ -65,6 +65,15 @@ pub enum AuditEvent {
     /// every replica from `MetadataCommitApplier` with full before /
     /// after descriptor versions + HLC + raw SQL text. (J.4)
     DdlChange = 22,
+    /// Session handle resolve failed fingerprint check — caller's
+    /// (tenant_id, ip) didn't match the fingerprint captured at
+    /// `SessionHandleStore::create()`. Signals handle theft across
+    /// origins even when the handle itself is otherwise valid.
+    SessionHandleFingerprintMismatch = 23,
+    /// Resolve-miss rate on a single connection crossed the configured
+    /// threshold within the detection window. Signals enumeration
+    /// attempts or misconfigured clients probing bogus handles.
+    SessionHandleResolveMissSpike = 24,
 }
 
 impl AuditEvent {
@@ -103,6 +112,9 @@ impl AuditEvent {
             Self::QueryExec | Self::RlsDenied => AuditLevel::Full,
             Self::RowChange => AuditLevel::Forensic,
             Self::DdlChange => AuditLevel::Standard,
+            Self::SessionHandleFingerprintMismatch | Self::SessionHandleResolveMissSpike => {
+                AuditLevel::Standard
+            }
         }
     }
 }