fix(security): anti-replay, 0600 client key, open redirect, supply-chain

Address findings from a repo security review:

- core: add a sliding-window anti-replay filter over the AEAD-authenticated
  sequence in Session (poll_input/poll_frame), closing the input-replay gap the
  data plane previously left to the LAN/VPN trust assumption. 4096-deep window,
  unit-tested; the encrypted loopback suite confirms no false drops.
- clients: write the mTLS client private key 0600 and lock the config dir 0700
  on Unix (it was world-readable at the umask default), re-locking existing
  stores on load. pf-client-core::trust plus the probe's own identity writer.
  Windows keeps the %APPDATA% ACL; Android/Apple already wrap the key.
- web: fix a post-login open redirect — resolve `next` via URL and require it to
  stay same-origin, rejecting `/\evil.com` and tab/encoding variants the old
  `!startsWith("//")` guard missed. Also fixes the dead safeNextPath helper.
- ci: SHA-256-pin the BtbN FFmpeg DLLs bundled into the signed Windows installer
  (were fetched from the rolling `latest` tag unverified); fails closed on a
  re-roll, matching the VB-CABLE gate.
- ci: fail-open fork-guard on the Windows/Apple host-mode PR build jobs that
  share runner labels with the signing jobs. Definitive fix stays server-side
  (Gitea outside-collaborator approval / isolated PR runners) — see the notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

crates/pf-client-core/src/trust.rs

@@ -34,16 +34,61 @@ pub fn load_or_create_identity() -> Result<(String, String)> {
     let dir = config_dir()?;
     let (cp, kp) = (dir.join("client-cert.pem"), dir.join("client-key.pem"));
     if let (Ok(c), Ok(k)) = (std::fs::read_to_string(&cp), std::fs::read_to_string(&kp)) {
+        // An older build wrote the key with a plain `fs::write`, which honors the umask and
+        // typically lands 0644 — world-readable. Re-lock an existing store on load so upgrades
+        // get fixed, not just fresh installs. Best-effort (a read-only store keeps what it has).
+        #[cfg(unix)]
+        lock_identity_perms(&dir, &kp);
         return Ok((c, k));
     }
     let (c, k) = endpoint::generate_identity().map_err(|e| anyhow!("generate identity: {e}"))?;
     std::fs::create_dir_all(&dir)?;
+    // The private key authorizes this client for full remote control of a paired host, so it must
+    // never be world-readable: lock the dir to the owner (0700) and create the key 0600 from the
+    // start (`fs::write` alone honors the umask → typically 0644). The certificate is public. On
+    // non-Unix the %APPDATA% profile ACL already scopes the dir to the user, so std perms suffice.
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        std::fs::set_permissions(&dir, std::fs::Permissions::from_mode(0o700))?;
+    }
     std::fs::write(&cp, &c)?;
-    std::fs::write(&kp, &k)?;
+    write_private_key(&kp, k.as_bytes())?;
     tracing::info!(cert = %cp.display(), "generated client identity");
     Ok((c, k))
 }
 
+/// Write the client's mTLS private key owner-only. On Unix the file is created with mode 0600 from
+/// the outset — an `fs::write` + later `chmod` would briefly expose it at the umask default. On
+/// other platforms std's default perms plus the %APPDATA% profile ACL scope it to the user.
+fn write_private_key(path: &std::path::Path, bytes: &[u8]) -> Result<()> {
+    #[cfg(unix)]
+    {
+        use std::io::Write;
+        use std::os::unix::fs::OpenOptionsExt;
+        let mut f = std::fs::OpenOptions::new()
+            .write(true)
+            .create(true)
+            .truncate(true)
+            .mode(0o600)
+            .open(path)?;
+        f.write_all(bytes)?;
+    }
+    #[cfg(not(unix))]
+    std::fs::write(path, bytes)?;
+    Ok(())
+}
+
+/// Best-effort re-lock of an already-present identity (dir 0700, key 0600) — for stores written by
+/// an older build that left the key world-readable. Errors are ignored: the worst case is the
+/// pre-existing perms, which this never loosens.
+#[cfg(unix)]
+fn lock_identity_perms(dir: &std::path::Path, key: &std::path::Path) {
+    use std::os::unix::fs::PermissionsExt;
+    let _ = std::fs::set_permissions(dir, std::fs::Permissions::from_mode(0o700));
+    let _ = std::fs::set_permissions(key, std::fs::Permissions::from_mode(0o600));
+}
+
 pub fn hex(fp: &[u8; 32]) -> String {
     fp.iter().map(|b| format!("{b:02x}")).collect()
 }