security: remediate two review passes + harden REST/JSON-RPC macros

[JedimEmO]

Summary

Consolidates three security/quality workstreams onto one branch. The tree is green throughout: 855 tests pass, clippy -D warnings clean, cargo deny check advisories + cargo audit clean. Crate versions are bumped and the { path, version } requirements cascaded per VERSIONING.md.

1. External security review remediation (H1–H4, M1–M6, L1–L3, D1)

Every code-level claim in the review was verified true; overstated severities were downscoped rather than inflated.

• H1 OAuth2 reserved-parameter denylist · H2 cookie auth requires CSRF (validate() fails closed; with_cookie / generated auth_cookie auto-install a default CsrfConfig) · H3 WebSocket/upgrade errors sanitized (ServerError::client_message()) · H4 oauth2-demo hardened (fragment token delivery, binding cookie, CORS pinned, admin gated on email_verified).
• M1 JSON-RPC 403 no longer leaks the caller's grant set · M2 default OAuth start-flow binds against login CSRF · M3 optional iss/aud on JWT sessions · M4 an empty permission group can no longer grant any authenticated user (runtime deny + compile error in all four macros) · M5 WS bearer extraction matches HTTP · M6 id_token issuer/sub/azp fail closed.
• L1 redacting Debug for secrets · L2 constant-time CSRF compare · L3 README wording.

2. rest_service! hardening + jsonrpc_service! parity

From a device-integration adopter's feedback, then mirrored in JSON-RPC:

• Content-Type enforcement (415, opt-out require_json_content_type), malformed-body and rejection logging, docs_require_auth gate, per-endpoint body_limit and opt-in headers, empty 204/205 body, 413-vs-400 split, and a build-time auth-provider assertion.

3. Multi-agent review remediation

A 4-agent review of the branch surfaced 28 findings (0 critical, no auth bypass in the default stack). Fixed the real ones:

• 204 empty body no longer breaks the generated client for non-unit response types (deserializes empty as null).
• OAuth2 request-object denylist (request/request_uri/response_mode/…) + id_token sub requirement (fail-closed binding).
• CsrfConfig::validate() rejects CORS-safelisted header names (the header_presence_only footgun).
• REST generated code logs via a ras_rest_core::tracing re-export — no undeclared consumer dependency (parity with the JSON-RPC fix).
• All documented dependency version pins re-synced; six re-exporting crates bumped to 0.2.0 + cascade.

Verification

cargo test --workspace            # 855 passed, 0 failed
cargo clippy --workspace --all-targets --locked -- -D warnings
cargo deny check advisories       # advisories ok
cargo audit                       # exit 0

🤖 Generated with Claude Code