fix(gateway)!: replace token cookies with revocable sessions and harden abuse controls

- Replace user:token cookies with opaque server-side sessions, revocable on logout, delete, recreate and expiry; bind every credential to the path user and add cross-user regression tests.
- Rate-limit /users and /login, add optional signup invite codes and form same-origin checks, and unify login failures to 401.
- Require explicit ALLOW_INSECURE_COOKIES for plain HTTP, use __Host-dsh_gw_session when secure, and fix secure cookie deletion.
- Strip client-supplied forwarding/SSO headers, add an optional upstream allowlist, per-user in-flight and WebSocket message caps, credential-free handshake errors, and sweep-time state pruning.
- Digest-pin base images, hash-pin gateway dependencies, verify DSH_COMMIT in the build, and run the gateway image as non-root with a pinned Python base.
- Update manifests, production checklist, architecture/security docs and add an SSO preflight script.

BREAKING CHANGE: existing dsh_gw_session=<user>:<token> cookies are invalid; users must sign in again. Unknown users on POST /login now return 401 instead of 404, and the gateway refuses COOKIE_SECURE=false unless ALLOW_INSECURE_COOKIES=1.

versions.env

@@ -2,10 +2,17 @@
 # repository. Consumed by the Makefile, build.sh, scripts/*.sh and the GitHub
 # Actions workflows. Never hard-code these values elsewhere: run "make check"
 # (scripts/check-versions.sh) to verify every pin.
+#
+# Every container image below is pinned to an immutable multi-arch index digest
+# (name:tag@sha256:...), not just a mutable tag. Bump the tag and the digest
+# together; scripts/check-versions.sh requires the digest form.
 
 # Upstream DeepSeek Harness source, and the ref this repository packages.
+# DSH_COMMIT is the full commit SHA that DSH_VERSION resolves to upstream; the
+# Dockerfile verifies the clone's HEAD against it and fails the build on drift.
 DSH_REPO=https://github.com/deepseek-ai/deepseek-harness.git
 DSH_VERSION=dsh-v0.2.1-rc.5
+DSH_COMMIT=b830ec950faba0a46dda564be3e2d854afed94f1
 PNPM_VERSION=11.28.5
 
 # Release identity = DSH_VERSION plus an optional repository revision.
@@ -15,10 +22,17 @@ PNPM_VERSION=11.28.5
 # repository-only change at the same ref becomes -r2.
 RELEASE_REVISION=
 
+# Base images for the main DSH Web image (root Dockerfile), pinned by digest.
+NODE_BUILD_IMAGE=docker.io/node:24-trixie@sha256:8c761eca2bf7eec965f946cf47b8090143cb41f45f2f8699af0cc0298d2d2d19
+NODE_RUNTIME_IMAGE=docker.io/node:24-trixie-slim@sha256:54f84b4cf8432b21aaffd5d3ce8d41e12cea0d10d33c09d2f3c9879d49d6b446
+
+# Base image for the example gateway (examples/dsh-agents-as-a-service/gateway).
+GATEWAY_PYTHON_IMAGE=docker.io/python:3.12-slim@sha256:aa943ce411423c7582288f18707ff66eddcbaeb510502d747a72aeb34f30d159
+
 # Control-plane versions used by the examples and their manifests.
 AGENT_SANDBOX_VERSION=v1.0.8
 GATEWAY_API_VERSION=v1.2.1
-OAUTH2_PROXY_IMAGE=quay.io/oauth2-proxy/oauth2-proxy:v7.15.5
+OAUTH2_PROXY_IMAGE=quay.io/oauth2-proxy/oauth2-proxy:v7.15.5@sha256:8498b0d0ef0a7b29686414000a08aee467f02d0299c9ed1e006a8f33fc017916
 
 # Registry layout: the main image is the repository itself, and every example
 # component is a nested package below it (<registry>/<owner>/<repo>/<example>/<component>).