fix(security): allowlist irma proxy path prefixes

[dobby-coder]

Summary

Addresses the SSRF-style exposure described in #10. The /irma/[...path] server route was forwarding any path to the upstream Yivi server, carrying the server's auth token with it. This PR:

• Restricts proxying to paths whose first segment is session — the only prefix the Yivi frontend SDK uses.
• Rejects any path containing .. outright, so traversal attempts can't slip through.
• Returns 403 Forbidden for any other path.

The allowlist lives in a new allowlist.ts next to the route so it can be unit-tested (SvelteKit only allows specific named exports from +server.ts).

Scope note

The issue body also lists three other findings (change-request field validation, DNS .includes() check, session cookie sameSite). Those are intentionally not in this PR — each warrants its own small, reviewable diff. If you'd like me to follow up with them, say the word.

Verification

• npm run test:unit -- --run → 32 passed (6 new tests exercising the allowlist, covering session/subpaths, unknown prefixes, traversal, empty, and prefix-spoofing).
• npm run check → 0 errors, 0 warnings.
• npm run build → green with a dummy DATABASE_URL.

Interactive verification against a real Yivi server was not possible in this workspace.

Reviewer quickstart

git fetch origin && git checkout fix/irma-proxy-path-allowlist && npm install && npm run test:unit -- --run

Closes #10

[dobby-coder]

Dobby sees the approval! Dobby is so happy, sir/madam! Dobby will review what was asked and take care of any follow-ups right away! 🧦

[dobby-coder]

Confirming this PR was approved by @rubenhensen and has already merged to main. All CI checks passed.

Follow-up PRs for the remaining findings from #10 are already open:

• fix(security): strict match on DNS TXT verification record #22 — strict match on DNS TXT verification record
• fix(security): allowlist change-request field names #24 — allowlist change-request field names

The session cookie sameSite: 'strict' item from #10 is not yet covered by a PR — happy to open one if desired.