chore(sync): mirror backend .py + Dockerfile to Space (hf-sync-backend)

Automated backend sync from szl-holdings/a11oy main via hf-sync-backend.
Updated (differed from the Space): szl_connectors/base.py, szl_connectors/oauth.py
Deleted (gone from the repo + Dockerfile COPY set): (none)

Keeps the Space-built backend (serve.py + the Dockerfile-COPY'd .py
modules) identical to GitHub main so the Space never rebuilds from a
stale backend, new endpoints don't 404 there, and orphaned modules
removed from the repo don't linger in the Space tree.

szl_connectors/base.py

@@ -154,9 +154,27 @@ def http_text(url: str, headers: dict | None = None, timeout: float = _TIMEOUT)
         return 0, str(e)
 
 
+# Credential fingerprints are derived with PBKDF2-HMAC-SHA256, not a single
+# SHA-256 pass. A bare hash of a (possibly low-entropy) credential is cheap to
+# brute-force / rainbow-table from the fingerprint alone (CodeQL
+# py/weak-sensitive-data-hashing). The fixed domain-separation salt keeps the
+# fingerprint DETERMINISTIC — the same credential always maps to the same
+# fingerprint, which is the whole point of a correlation fingerprint — while the
+# work factor makes recovery expensive. An optional deployment pepper
+# (SZL_FINGERPRINT_PEPPER) adds a keyed secret an attacker cannot precompute.
+_CRED_FP_SALT = b"szl.killinchu.cred-fingerprint.v1"
+_CRED_FP_ITERATIONS = 200_000
+
+
 def cred_fingerprint(value: str) -> str:
-    """SHA-256 fingerprint of a credential — what a receipt may carry. NEVER the value."""
-    return "sha256:" + hashlib.sha256(value.encode("utf-8")).hexdigest()[:32]
+    """Brute-force-resistant fingerprint of a credential — what a receipt may
+    carry. NEVER the value. PBKDF2-HMAC-SHA256 over a deterministic salt (+ the
+    optional SZL_FINGERPRINT_PEPPER) so a low-entropy credential cannot be
+    recovered from its fingerprint, yet the same credential always maps to the
+    same fingerprint."""
+    salt = _CRED_FP_SALT + os.environ.get("SZL_FINGERPRINT_PEPPER", "").encode("utf-8")
+    dk = hashlib.pbkdf2_hmac("sha256", value.encode("utf-8"), salt, _CRED_FP_ITERATIONS)
+    return "pbkdf2-sha256:" + dk.hex()[:32]
 
 
 # ── the honesty core — resolve_state() ─────────────────────────────────────

szl_connectors/oauth.py

@@ -92,11 +92,26 @@ PROVIDER_OAUTH: dict[str, dict[str, str]] = {
 }
 
 
+# Domain-separation salt + work factor for deriving the state-signing key.
+_STATE_KDF_SALT = b"szl.killinchu.oauth-state.v1"
+_STATE_KDF_ITERATIONS = 200_000
+_STATE_KEY_CACHE: dict[str, bytes] = {}
+
+
 def _state_secret() -> bytes:
     # signed-state nonce key: reuse the cosign-adjacent secret if present, else a
     # per-process ephemeral key (state still verifiable within the process).
+    # Stretched with PBKDF2-HMAC-SHA256 rather than a single SHA-256 pass so a
+    # low-entropy secret (e.g. the ephemeral fallback) cannot be cheaply
+    # brute-forced from a leaked state signature (CodeQL
+    # py/weak-sensitive-data-hashing). Cached per secret so the stretch is a
+    # one-time cost while still honouring a changed secret.
     s = os.environ.get("SZL_OAUTH_STATE_SECRET") or os.environ.get("SZL_COSIGN_PRIVATE_PEM") or "szl-oauth-ephemeral"
-    return hashlib.sha256(s.encode()).digest()
+    key = _STATE_KEY_CACHE.get(s)
+    if key is None:
+        key = hashlib.pbkdf2_hmac("sha256", s.encode(), _STATE_KDF_SALT, _STATE_KDF_ITERATIONS)
+        _STATE_KEY_CACHE[s] = key
+    return key
 
 
 def _b64u(b: bytes) -> str: