Harden sign-in and password reset

- OTP attempt limits, constant-time compare, random reference codes
- DB-backed rate limits (429) on sign-in, OTP, reset, register, onboarding
- one generic sign-in failure message; reset request no longer reveals accounts
- no password kept in the session; real status codes on failures

app/login/api/engine/invited_onboarding.php

@@ -49,7 +49,7 @@ $token   = $_SESSION['invited_token'];
 // ── Step 2: CSRF check ────────────────────────────────────────────────────────
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $csrf = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
-    if (empty($csrf) || $csrf !== ($_SESSION['csrf_token'] ?? '')) {
+    if (empty($csrf) || !hash_equals((string)($_SESSION['csrf_token'] ?? ''), $csrf)) {
         http_response_code(403);
         $answer['message'] = 'Invalid request.';
         exit(json_encode($answer));