feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/pkg/openidentity/external_identity_test.go

@@ -1,3 +1,5 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package openidentity
 
 import (
@@ -269,3 +271,33 @@ func flipLastChar(signature string) string {
 func itoa(value int64) string {
 	return strconv.FormatInt(value, 10)
 }
+
+func TestRequireSignedIdentityRejectsUnsignedAndInvalidSignatures(t *testing.T) {
+	for _, signature := range []string{"", "invalid"} {
+		ctx, _ := newIdentityContext(map[string]string{"X-External-Id": testUserID, "X-External-Id-Signature": signature})
+		if _, err := GetExternalUser(ctx, Secrets{ChannelID: testChannelID, IdentityHMAC: testSecret, RequireSignedIdentity: true}); err == nil {
+			t.Fatal("signed-only policy accepted an unsigned or invalid identity")
+		}
+	}
+	ctx, _ := newIdentityContext(signedIdentityHeaders(testSecret, testChannelID, testUserID, time.Now()))
+	user, err := GetExternalUser(ctx, Secrets{ChannelID: testChannelID, IdentityHMAC: testSecret, RequireSignedIdentity: true})
+	if err != nil || user.IdentityScope != IdentityScope(testChannelID, "hmac") {
+		t.Fatal("valid signed identity did not retain its HMAC scope")
+	}
+}
+
+func TestIdentityScopeSeparatesIssuersAndChannels(t *testing.T) {
+	seen := map[string]bool{}
+	for _, channel := range []string{"channel-one", "channel-two"} {
+		for _, issuer := range []string{"guest", "hmac", "jwt"} {
+			scope := IdentityScope(channel, issuer)
+			if scope == "" || seen[scope] {
+				t.Fatal("identity scopes collided")
+			}
+			seen[scope] = true
+		}
+	}
+	if IdentityScope("", "hmac") != "" || IdentityScope("channel", "unknown") != "" {
+		t.Fatal("invalid scope inputs accepted")
+	}
+}