T03 — keep secrets out of profanity.log:
- new redact_secrets() helper (common.c) masks the content of SASL
auth/response/challenge/success and <password> elements; applied in
the libstrophe logger (_xmpp_file_logger) and the stderr-to-log
bridge (REQ-DAR-03, REQ-LOG-06)
- _add_to_db() no longer logs decrypted message bodies or the full
INSERT statement (REQ-DAR-03)
T07 — owner-only permissions on key material and history (REQ-AUTH-01):
- chmod 0600 on chatlog.db after open (journal/WAL files inherit)
- chmod 0600 on OTR keys.txt and fingerprints.txt after every write
- parent dirs are already 0700 (create_dir); this is defense in depth
T08 — integrity before trust:
- PRAGMA quick_check(1) gates every chatlog.db open; on failure the
DB stays closed, the user is warned once in the console and the
session continues without history (REQ-RES-02)
- OMEMO aesgcm downloads decrypt into a 0600 tempfile next to the
target and rename it into place only after the GCM tag verifies;
the open-command hook no longer runs on failed decryption
(REQ-CRY-06)
Tests: redact_secrets unit tests; AES-256-GCM roundtrip and
tampered-tag/ciphertext unit tests (crypto.c now linked into
unittests under BUILD_OMEMO); functional test planting a corrupt
chatlog.db and asserting graceful degradation.
Closes#146
