fix(security,ops): close ukmesh auth/users findings (#50 #51 #52 #53 #58) (#103)

* docs: add C5a mission handoff

* security: classify channel keys and baseline reviewed findings

* security: revalidate MQTT auth and revoke owner sessions

* test(ops): cover concurrent newuser grant updates

* fix(ops): preserve executable newuser test

* fix(ops): cover partial newuser rollback failures

* fix(owner): preserve password whitespace during login

* docs: add C5c mission handoff

* test(cache): drop stale authCache policy entry (cache removed by auth revalidation)

* docs: keep HANDOFF on current mission

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
Co-authored-by: hermes-gadget <284726080+hermes-gadget@users.noreply.github.com>

.github/workflows/ci.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches: ['**']
   pull_request:
+  schedule:
+    - cron: '17 4 * * *'
 
 permissions:
   contents: read
@@ -14,6 +16,7 @@ concurrency:
 
 jobs:
   backend:
+    if: github.event_name != 'schedule'
     name: Backend
     runs-on: ubuntu-latest
     services:
@@ -62,6 +65,7 @@ jobs:
       - run: npm run build
 
   frontend:
+    if: github.event_name != 'schedule'
     name: Frontend
     runs-on: ubuntu-latest
     defaults:
@@ -81,6 +85,7 @@ jobs:
       - run: npm run build
 
   workers-and-compose:
+    if: github.event_name != 'schedule'
     name: Workers and Compose
     runs-on: ubuntu-latest
     env:
@@ -407,3 +412,7 @@ jobs:
         uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_VERSION: 8.30.0
+      - name: Scan full repository history on push and pull request
+        if: github.event_name != 'schedule'
+        run: gitleaks git --redact --no-banner --log-opts=--all