fix: verify all six unproven audit findings — four real, two not

The audit that produced these had every verifier agent die, so none were
confirmed. Checked each against the running system rather than guessing.

1. COOKIE Secure FLAG — REAL, fixed. The Cloudflare Tunnel runs OFF this box
   (observed source 10.30.20.67, 155 requests in the journal) and uvicorn
   only honours X-Forwarded-* from --forwarded-allow-ips, default 127.0.0.1.
   Proven by hitting the LAN IP with X-Forwarded-Proto: https and watching
   Secure vanish from Set-Cookie. Every internet visitor's session cookie
   was going out without it.
   Fixed in the unit drop-in with --proxy-headers and an allow-list scoped
   to the tunnel host — NOT "*", because trusting that header from anywhere
   would let a LAN client forge the IP the per-IP limiters key on. Verified
   both directions: trusted source + header gets Secure, plain LAN http
   correctly does not, and a spoof from an untrusted host is ignored.

2. DOUBLE GUEST ON REMOUNT — REAL but narrow, left alone. The guestAttempted
   ref already covers StrictMode's double-effect (refs survive it). The only
   hole is unmounting during the in-flight request, which needs navigating
   away and back inside ~200ms and costs one unused row. Not worth
   complicating the open door's happy path for.

3. SILENT REDIRECT WHEN RATE-LIMITED — REAL, fixed. A visitor whose guest
   provisioning was refused got bounced to /enter with no explanation — and
   at 5/hour/IP a household or cafe behind one NAT reaches that easily. The
   failure reason (the backend's own in-fiction line) now rides along in
   router state and /enter shows it, so nobody is silently handed a login
   form they never asked for.

4. RATE LIMITER KEYS NEVER EVICTED — REAL, fixed. defaultdict entries
   survived forever even once their hit list emptied. The open door made
   this materially worse: every visitor is now a real account, so every
   visitor permanently added a key across eleven limiter instances. Added an
   opportunistic sweep every 512 admitted calls — no background task, cost
   lands on whoever generates the load. Three tests; verified they catch it
   by disabling the sweep and watching one fail.

5. SUMMON RACE vs TELEMETRY — REAL, fixed. Nothing serialised summoning.
   _handle_anomaly checks `state.entity is None` then awaits a summon
   containing a multi-second LLM mint, and the ESP32's HTTP ingestion path
   calls _handle_anomaly on the SAME SeanceState — which is the entire point
   of the device integration. Both could pass the check: two entities
   minted, two essence credits, two item rolls, state.entity clobbered by
   whichever finished last. Now guarded by a per-session asyncio.Lock.

6. LEGACY ENTITIES STUCK AT DEFAULT TRAITS — mechanism REAL, zero rows
   affected here. The ALTER defaults traits to '{}' with no backfill and
   roll_traits only runs at mint, so a pre-migration spirit would read 0.5
   for everything — making `trust` always correct and `cross_over`
   unreachable. This install has 0 such rows. Added a signature-seeded
   backfill anyway, guarded to empty-traits rows so it can never touch a
   spirit that already has a real nature.

(A seventh claim from the same batch — that iOS EMF is silently dead — was
refuted earlier and deliberately left untouched.)

34 targeted tests pass; deployed and verified live.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/tests/test_rate_limit.py

@@ -46,3 +46,61 @@ def test_resolve_client_ip_falls_back_to_socket_peer_without_header():
 
 def test_resolve_client_ip_falls_back_to_unknown_with_no_peer_or_header():
     assert resolve_client_ip({}, None) == "unknown"
+
+
+# --- key eviction -----------------------------------------------------------
+
+
+class TestKeyEviction:
+    """Keys must not accumulate forever.
+
+    The open door provisions a real account per visitor, so every visitor
+    contributes a distinct user-id key to each limiter. Without eviction a
+    long-running process grows without bound.
+    """
+
+    def test_stale_keys_are_swept(self, monkeypatch):
+        limiter = RateLimiter(max_requests=5, window_seconds=60)
+        clock = {"t": 1000.0}
+        monkeypatch.setattr("app.rate_limit.time.monotonic", lambda: clock["t"])
+
+        # A burst of one-shot visitors, each seen exactly once.
+        for i in range(RateLimiter.SWEEP_EVERY):
+            limiter.allow(f"visitor-{i}")
+        assert limiter.tracked_keys == RateLimiter.SWEEP_EVERY
+
+        # Long after their window has closed, one more call triggers a sweep.
+        clock["t"] += 10_000
+        for i in range(RateLimiter.SWEEP_EVERY):
+            limiter.allow(f"later-{i}")
+
+        # The original cohort is gone; only the recent one is retained.
+        assert limiter.tracked_keys <= RateLimiter.SWEEP_EVERY + 1
+
+    def test_sweeping_never_forgets_an_active_key(self, monkeypatch):
+        """A sweep must not hand someone a fresh budget mid-window."""
+        limiter = RateLimiter(max_requests=2, window_seconds=60)
+        clock = {"t": 500.0}
+        monkeypatch.setattr("app.rate_limit.time.monotonic", lambda: clock["t"])
+
+        assert limiter.allow("steady") is True
+        assert limiter.allow("steady") is True
+        assert limiter.allow("steady") is False
+
+        # Force many sweeps while "steady" stays inside its window.
+        for i in range(RateLimiter.SWEEP_EVERY * 2):
+            clock["t"] += 0.001
+            limiter.allow(f"noise-{i}")
+
+        # Still blocked — the sweep must not have dropped a live key.
+        assert limiter.allow("steady") is False
+
+    def test_a_key_recovers_normally_after_its_window(self, monkeypatch):
+        limiter = RateLimiter(max_requests=1, window_seconds=10)
+        clock = {"t": 0.0}
+        monkeypatch.setattr("app.rate_limit.time.monotonic", lambda: clock["t"])
+
+        assert limiter.allow("seeker") is True
+        assert limiter.allow("seeker") is False
+        clock["t"] += 11
+        assert limiter.allow("seeker") is True