feat: usos sign-in, private calendar feed and timetable archive

docs/security.md

@@ -0,0 +1,18 @@
+# What is stored and how
+
+| Data | Form |
+|---|---|
+| USOS access token and its secret | AES-256-GCM with `TOKEN_ENC_KEY`, bound to the user id and the field |
+| Calendar address token | 32 random bytes; a SHA-256 hash to look the feed up, and an encrypted copy to show the address on the page |
+| Browser session | 32 random bytes in an `HttpOnly`, `SameSite=Lax` cookie for seven days; only its SHA-256 hash is stored |
+| Timetable | Plain: course, class type, group, room, building, address, lecturers, times |
+| Profile | USOS user id and name |
+
+Only the `studies` and `offline_access` scopes are requested. No e-mail, no personal data, no grades.
+
+- Revoking or reissuing the calendar address replaces the stored hash in one statement; the next request to the old address is answered with 404.
+- Sign-out revokes the token in USOS, then deletes the tokens, the calendar address and the sessions. With the checkbox, the user and the timetable are deleted as well.
+- When USOS rejects a token, it is deleted; the timetable stays until the user signs out with deletion.
+- Nothing is logged per request. Error logs carry the user id and the USOS error message, never a token, a signature or a calendar address. The reverse proxy in front must not log request paths of `/f/`.
+- Forms are protected against cross-site requests by the `Sec-Fetch-Site` and `Origin` check of Go's `http.CrossOriginProtection`. A sign-in is bound to the browser that started it by a one-time cookie.
+- The page sends `Content-Security-Policy: default-src 'none'` with inline styles only and has no scripts.