Refuse local development behind a TLS terminator and document sign-in

[ctfbruce]

The local development profile serves requests without a credential as the operator. Configuration validation refused it with TLS enabled, payments enabled or a non-loopback bind host, but accepted it together with server.behind_tls_terminator, which is the shape of a dispatcher published through a reverse proxy. That combination is now refused when the configuration is read; enabled providers and the public authentication URL already require TLS or the terminator, so this one case also excludes them.

Private error diagnostics now redact the sign-in callback's code and state query values as well, and the CSRF header they redact is the X-Debuglet-CSRF header this API uses; the previous name matched no request header.

New tests cover the refusal, the redaction, a GitHub token endpoint answering 503 and a cancelled GitHub sign-in (both leave no account or session), and linking a CILogon identity to a GitHub-created account through the real provider callbacks, including the refusal of a subject owned by another account. No handler behaviour changed for those cases.

Documentation: the threat model gains an accounts, sessions and provider sign-in section (boundaries, lifetimes and scopes, the protections against login CSRF, code interception, forged tokens, provider mix-up, open redirects, session fixation and device-login phishing, the linking and recovery rules, what is logged, and the local development profile's requirements). The authentication guide gains sections on provider registration ownership, renewal and callback changes, including credential rotation through the configuration update as delivered by #364, and on provider-side incidents. The deployment guide states that a second dispatcher is unsupported and not detected at startup, and that restart and restore are the supported recovery.

References #226, #223, #221, #227 and #122. The rotation paragraph describes the configuration update after #364; merge that first. Real-provider staging acceptance is not performed by this change.

Validation: base reproduction shows the terminator row and the three retained sentinels failing; on the fixed tree gofmt and vet are clean and the targeted tests pass under the race detector, as do the complete internal/dispatcher/transport/api, cmd/dispatcher and internal/dispatcher/config packages. Candidate CI on the pushed head is linked below once it completes.