feat(security): login anomaly detection, account recovery flow, scoped API keys, and enterprise SSO

[Cyber-builder]

Closes #1780
Closes #1781
Closes #1782
Closes #1783

Summary of Changes

• Add account recovery flow #1780 Add account recovery flow:

  • Implemented AccountRecoveryService providing a secure multi-step account recovery process.
  • Identity verification: Generates cryptographically secure, HMAC-SHA256 hashed recovery tokens with timing-safe verification and optional security challenges.
  • Rate-limited: Enforces per-identifier and per-IP sliding window limits with automatic lockout after consecutive failed attempts.
  • Audited: Emits domain events (auth.account_recovery_completed) and maintains an append-only audit trail for all recovery events.
  • Added unit test suite in accountRecoveryService.test.ts.

• Add login anomaly detection #1781 Add login anomaly detection:

  • Implemented LoginAnomalyService for flagging suspicious authentication attempts.
  • Heuristics defined: Haversine distance-based impossible travel velocity (>800 km/h), unrecognized device fingerprints, bursts of preceding failed attempts, rapid IP hopping (<5 mins), and unusual hours.
  • Alerts emitted: Publishes security.login_anomaly_alert domain events to the event bus, notifies registered alert listeners, and records structured anomaly alerts.
  • Tunable: Fully customizable runtime thresholds and heuristic weightings via updateConfig().
  • Added unit test suite in loginAnomalyService.test.ts.

• Add enterprise SSO (SAML/OIDC) #1782 Add enterprise SSO (SAML/OIDC):

  • Extended SSOService to execute Just-in-Time (JIT) provisioning during SAML and OIDC authentication callbacks.
  • Synchronizes user profile and translates IdP group memberships into SubTrackr platform roles (admin, billing, viewer).
  • Added comprehensive enterprise SSO guide in ENTERPRISE_SSO.md.
  • Added JIT callback tests in SSOService.test.ts.

• Add scoped API keys with expiry #1783 Add scoped API keys with expiry:

  • Updated ApiKeyRotationService, apiKeyRotation.ts, and interfaces.ts to support granular scopes and configurable expiration dates.
  • Scopes enforced: Added hasScope validator supporting exact scopes, universal wildcard (*), and namespace wildcards (read:*), rejecting unauthorized access with AUTH_API_KEY_INSUFFICIENT_SCOPE.
  • Expiry enforced: Enforces expiration timestamps upon validation, automatically transitioning expired keys to expired.
  • Added unit test suite in scopedApiKey.test.ts.

[drips-wave]

@Cyber-builder Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits