sec: hash tokens in DB, set Tauri CSP, escape quotes in XSS guard

- Session and email verification/reset tokens stored as SHA-256 hash in DB
  (raw token stays client-side in cookie/email link)
- Tauri CSP set: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data: https:; connect-src 'self' wss: https:
- escapeHtml now handles double and single quotes to prevent attribute-based XSS

internal/auth/email_handlers.go

@@ -30,10 +30,11 @@ func (h *Handler) RequestVerification(w http.ResponseWriter, r *http.Request) {
 	}
 
 	token := generateToken()
+	tokenHash := hashToken(token)
 	_, err = h.db.ExecContext(r.Context(), `
 		INSERT INTO user_tokens (user_id, token, type, expires_at)
 		VALUES ($1, $2, 'verify_email', NOW() + INTERVAL '24 hours')
-	`, userID, token)
+	`, userID, tokenHash)
 	if err != nil {
 		http.Error(w, `{"error":"failed to generate token"}`, http.StatusInternalServerError)
 		return
@@ -63,7 +64,7 @@ func (h *Handler) VerifyEmail(w http.ResponseWriter, r *http.Request) {
 		DELETE FROM user_tokens
 		WHERE token = $1 AND type = 'verify_email' AND expires_at > NOW()
 		RETURNING user_id
-	`, req.Token).Scan(&userID)
+	`, hashToken(req.Token)).Scan(&userID)
 	if err != nil {
 		http.Error(w, `{"error":"invalid or expired token"}`, http.StatusBadRequest)
 		return
@@ -100,10 +101,11 @@ func (h *Handler) RequestPasswordReset(w http.ResponseWriter, r *http.Request) {
 	}
 
 	token := generateToken()
+	tokenHash := hashToken(token)
 	_, err = h.db.ExecContext(r.Context(), `
 		INSERT INTO user_tokens (user_id, token, type, expires_at)
 		VALUES ($1, $2, 'reset_password', NOW() + INTERVAL '1 hour')
-	`, userID, token)
+	`, userID, tokenHash)
 	if err != nil {
 		http.Error(w, `{"error":"failed to generate token"}`, http.StatusInternalServerError)
 		return
@@ -134,7 +136,7 @@ func (h *Handler) ResetPassword(w http.ResponseWriter, r *http.Request) {
 		DELETE FROM user_tokens
 		WHERE token = $1 AND type = 'reset_password' AND expires_at > NOW()
 		RETURNING user_id
-	`, req.Token).Scan(&userID)
+	`, hashToken(req.Token)).Scan(&userID)
 	if err != nil {
 		http.Error(w, `{"error":"invalid or expired token"}`, http.StatusBadRequest)
 		return