Hub: accounts, IMVU linking by tagline, proxy sign-in, presence, console

People sign up on the website and link IMVU accounts by putting a code in the account's tagline, which the
hub reads from IMVU's public API (the most recent proof wins; link caps per person). IMVU's age verification
or Access Pass make an account adult. T5DE's proxy signs in with a device code and keeps a WebSocket open,
reporting the IMVU account in use and the community products it wears; /online shows those who opted in.
Moderators get a console: who's online, people, link caps, bans, roles, and the audit log. Tests run the
website and API against an embedded Postgres and a fake IMVU API.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

internal/token/token_test.go

@@ -0,0 +1,44 @@
+package token
+
+import (
+	"encoding/json"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestIssueAndCheck(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "key")
+	k, err := LoadOrCreate(path, "https://hub.test")
+	if err != nil {
+		t.Fatal(err)
+	}
+	tok, _ := k.Issue("person:1", "t5de-hub", "proxy", time.Minute)
+	c, err := k.Check(tok, "t5de-hub")
+	if err != nil || c.Subject != "person:1" || c.Scope != "proxy" {
+		t.Fatalf("%+v %v", c, err)
+	}
+	if _, err := k.Check(tok, "a-catalog"); err == nil {
+		t.Fatal("accepted for another audience")
+	}
+	// The same key comes back from the file.
+	k2, _ := LoadOrCreate(path, "https://hub.test")
+	if _, err := k2.Check(tok, "t5de-hub"); err != nil {
+		t.Fatal(err)
+	}
+	// Tampering and expiry are caught.
+	parts := strings.Split(tok, ".")
+	forged := parts[0] + "." + b64([]byte(`{"iss":"https://hub.test","sub":"person:2","aud":"t5de-hub","exp":9999999999}`)) + "." + parts[2]
+	if _, err := k.Check(forged, "t5de-hub"); err == nil {
+		t.Fatal("accepted a forged token")
+	}
+	old, _ := k.Issue("person:1", "t5de-hub", "", -time.Second)
+	if _, err := k.Check(old, "t5de-hub"); err == nil {
+		t.Fatal("accepted an expired token")
+	}
+	var jwks struct{ Keys []map[string]string }
+	if json.Unmarshal(k.JWKS(), &jwks) != nil || len(jwks.Keys) != 1 || jwks.Keys[0]["crv"] != "Ed25519" {
+		t.Fatalf("%s", k.JWKS())
+	}
+}