docs(security): STRIDE threat-model coverage matrix

[babs]

Summary

Closes T1.4 from misc/next-steps.md. New docs/threat-model.md enumerates 16 threats across STRIDE with one row each linking the mitigation to code, test, and (where applicable) runbook. Turns "we thought about this" into a reviewable, auditable artifact.

Coverage

• Spoofing (7) — active-IdP-session phishing, code/refresh/consent/callback-state replay, XFF spoofing, IdP error_description phishing
• Tampering (3) — DCR abuse (T+I), redirect-URI / open redirect, signing-key compromise / bulk revoke
• Repudiation (1) — multi-replica drift
• Information disclosure (3) — DCR (T+I), id_token claim-shape drift, IdP error_description phishing (S+I)
• Denial of service (3) — Redis outage, IdP outage, sealed-input parse exhaustion
• Elevation (1) — PKCE downgrade

Honest scope boundaries

Out-of-scope section names what the proxy explicitly does NOT defend against (IdP compromise, browser XSS, MITM-with-TLS-off, side-channel timing, post-quantum, operator-bypass-of-PROD_MODE, per-mount RBAC). Listed so future work picks up gaps explicitly rather than assuming coverage.

Live document, not write-once

Closing section ("How to use this document during review") names the discipline: when an auth/authz path changes, the matrix row's Mitigation column must keep matching the code or the row gets updated in the same PR. The matrix is the artifact a security reviewer or auditor reads first.

Cross-references

• Linked from README.md "Standards conformance" section.
• Linked from specs.md top-of-doc companion-docs line.
• main.go /register rate-limit constant carries a comment pointing at row 1 (DCR abuse) so a future reader changing the value sees the cross-reference.

Test plan

• CI green (this is a doc-only PR + 3-line main.go comment).
• Manual: every code path mentioned in a row was spot-checked during review against the actual repo state. Notable invariants verified: client_name control-byte strip at DCR (handlers/register.go:109), PROD_MODE violation list (config/config.go:415-450), FamilyIssuedAt + REVOKE_BEFORE apply to access AND refresh (middleware/auth.go:164, handlers/token.go:354), fragment-bearing redirect URIs rejected at DCR (handlers/register.go:153).
• No HMAC referenced — verified by grep that the proxy uses AES-GCM (authenticated encryption) + SHA-256 (key derivation + PKCE-S256) only.