fix(gateway)!: replace token cookies with revocable sessions and harden abuse controls

- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests.
- Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401.
- Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion.
- Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning.
- Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base.
- Update manifests, production checklist, architecture/security docs and add an SSO preflight script.

BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.

examples/dsh-agents-as-a-service/gateway/Dockerfile

@@ -1,16 +1,73 @@
-FROM python:3.12-slim
+# syntax=docker/dockerfile:1.7
+#
+# Example gateway image: the tenant-facing proxy in front of DSH sandboxes.
+# The base image is digest-pinned in versions.env (GATEWAY_PYTHON_IMAGE) and
+# scripts/check-versions.sh verifies the ARG default below.
+#
+# Two stages on that base:
+#   build    installs the fully hash-pinned runtime dependencies into /venv as
+#            a dedicated non-root UID, so the runtime stage copies a venv that
+#            contains no root-owned files.
+#   runtime  copies /venv and the app, runs as UID 10000 with HOME=/tmp and no
+#            writable location of its own: usable with readOnlyRootFilesystem.
+ARG GATEWAY_PYTHON_IMAGE=docker.io/python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159
 
-# Read-only-rootfs friendly: no .pyc writes, no home directory writes.
+# ---------------------------------------------------------------------------
+# Build stage: hash-pinned virtualenv owned by the runtime identity.
+# ---------------------------------------------------------------------------
+FROM $GATEWAY_PYTHON_IMAGE AS build
+
+ARG APP_UID=10000
+ARG APP_GID=10000
+
+# No .pyc writes and no user cache dirs: the runtime image stays read-only.
 ENV PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
+    PIP_NO_CACHE_DIR=1 \
     HOME=/tmp
 
-WORKDIR /app
+RUN groupadd --gid "$APP_GID" app \
+ && useradd --uid "$APP_UID" --gid "$APP_GID" --no-create-home \
+      --home-dir /tmp --shell /usr/sbin/nologin app \
+ && python -m venv /venv \
+ && chown -R "$APP_UID:$APP_GID" /venv
+
+WORKDIR /build
 COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-COPY gateway.py .
+
+# Install as the unprivileged user so every file in /venv is owned by UID 10000.
+# --require-hashes makes pip reject any requirement without a matching hash:
+# the dependency set in requirements.txt is fully pinned and verified. Use the
+# venv's own pip: the system pip would user-install into $HOME instead.
+USER $APP_UID:$APP_GID
+RUN /venv/bin/pip install --no-cache-dir --require-hashes -r requirements.txt
+
+# ---------------------------------------------------------------------------
+# Runtime stage
+# ---------------------------------------------------------------------------
+FROM $GATEWAY_PYTHON_IMAGE AS runtime
+
+ARG APP_UID=10000
+ARG APP_GID=10000
+
+ENV PYTHONDONTWRITEBYTECODE=1 \
+    PYTHONUNBUFFERED=1 \
+    HOME=/tmp \
+    PATH="/venv/bin:$PATH"
+
+RUN groupadd --gid "$APP_GID" app \
+ && useradd --uid "$APP_UID" --gid "$APP_GID" --no-create-home \
+      --home-dir /tmp --shell /usr/sbin/nologin app
+
+WORKDIR /app
+
+# Dependencies come from the build stage: same interpreter, no build tools left
+# in the runtime image and nothing owned by root inside /venv.
+COPY --from=build --chown=$APP_UID:$APP_GID /venv /venv
+COPY --chown=$APP_UID:$APP_GID gateway.py .
 
 EXPOSE 8080
+
 # Run as a fixed non-root UID; HOME=/tmp keeps caches out of the image.
 USER 10000