Closes the three actionable server Low findings from the 2026-07-06
review:
- #139: unknown-username logins now verify against a static bcrypt
dummy hash so both failure paths pay the same cost — response timing
no longer reveals which usernames exist.
- #140: register maps a unique-constraint violation to UsernameTaken
(409) — the SELECT pre-check stays as the friendly fast path, the
constraint is the arbiter for the concurrent case.
- #141: avatar uploads must start with the magic bytes of the declared
image type; the stored extension (which decides how the file is
re-served) is now backed by content, not the Content-Type header.
Unit tests: real/spoofed/truncated signatures for all four formats,
and the dummy hash's validity at BCRYPT_COST.
Closes#139Closes#140Closes#141
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
funman300