feat(life-call): add LM-33a panel authentication

[Daisuke134]

Summary

• add Telegram /panel generation of a 32-byte opaque token stored only as SHA-256 with uid, chat_id, five-minute expiry, and used_at
• atomically burn the token through claim_lm_panel_token, exchange it for a separate random 24-hour session, and redirect to token-free /panel
• require the HttpOnly, Secure, SameSite=Lax session for the placeholder panel showing Anicca Life Manager and uid
• keep /lm?tg= only for its verified onboarding handoff

Session storage choice: lm_panel_sessions keeps the separately random cookie value hash-only and reuses the existing service-role/PostgREST primitive without adding a signing secret.

Verification

• cd apps/life-call && npm test — PASS, exit 0
• node --test lib/panel-auth.test.js — 11 passed, 0 failed
• negative cases: reused token 403; expired token 403; tampered token 403; missing session 401

Migration and deployment

• additive SQL is included at apps/life-call/migrations/2026-07-21-lm33a-panel-auth.sql and is intentionally not applied; Fable applies it during E2E
• staging verification is skipped because Railway is BLOCKED-on-Dais
• no production deploy and no production webhook change

Primary guidance checked

• Node.js crypto.randomBytes: https://nodejs.org/api/crypto.html#cryptorandombytessize-callback — Generates cryptographically strong pseudorandom data.
• PostgreSQL UPDATE RETURNING: https://www.postgresql.org/docs/current/sql-update.html — RETURNING computes values from each row actually updated.
• MDN Set-Cookie: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Set-Cookie — HttpOnly forbids JavaScript access to the cookie.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: c5e00e4f-b87a-4920-859b-5b3557d9f17b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/lm33a-panel-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}