Add rails encryption for totp - allow configuration of encryption secrets from env, or derive them from SECRET_KEY_BASE. Don't leak email address via web_authn, rate limit web_authn, escape oidc state value, require password for changing email address, allow settings the hmac secret for token prefix generation

config/initializers/token_hmac.rb

@@ -1,6 +1,7 @@
 # Token HMAC key derivation
 # This key is used to compute HMAC-based token prefixes for fast lookup
 # Derived from SECRET_KEY_BASE - no storage needed, deterministic output
+# Optional: Set OIDC_TOKEN_PREFIX_HMAC env var to override with explicit key
 module TokenHmac
-  KEY = Rails.application.key_generator.generate_key('oidc_token_prefix', 32)
+  KEY = ENV['OIDC_TOKEN_PREFIX_HMAC'] || Rails.application.key_generator.generate_key('oidc_token_prefix', 32)
 end