fix: address CodeQL security findings

[suguanYang]

Summary

• add HMAC-based API key lookup hashing and a migration that disables legacy weak-hashed API keys
• harden URL file-type detection and SNS subscription confirmation against SSRF with validation, no redirect following, and IP pinning
• sanitize database health errors and remove the unnecessary database-info health API
• avoid printing local/bootstrap credentials to stdout
• add contract coverage for invalid URL redirects, SNS confirmation validation, database health sanitization, and API key hashing paths

Validation

• /home/suguan/.local/bin/uv run --all-packages --group lint ruff check apps packages
• /home/suguan/.local/bin/uv run --all-packages --group typecheck pyright --project pyproject.toml apps/api/app apps/api/main.py apps/worker/app apps/worker/worker.py packages/shared-python/shared
• /home/suguan/.local/bin/uv run --project apps/api --group dev pytest apps/api/tests/contract/test_database_health_contract.py -q (4 passed)
• /home/suguan/.local/bin/uv run --project apps/api --group dev pytest apps/api/tests/contract/test_api_key_contract.py apps/api/tests/contract/test_guest_registration_contract.py apps/api/tests/contract/test_job_creation_contract.py apps/api/tests/contract/test_s3_event_contract.py apps/api/tests/contract/test_database_health_contract.py -q (30 passed before removing the database-info endpoint/tests; affected health contract rerun now passes with 4 passed)
• /home/suguan/.local/bin/uv run --project apps/api --group dev pytest apps/api/tests/contract/test_job_read_contract.py apps/api/tests/contract/test_webhook_contract.py apps/api/tests/contract/test_api_key_contract.py -q (15 passed)
• CodeQL 2.25.2 python-security-extended.qls: security_extended_findings=0 on commit 3fd7868

Notes

• The API-key migration intentionally deactivates existing API keys because old unsalted SHA-256 lookup hashes cannot be safely converted to the new keyed HMAC hashes without plaintext keys. Existing users should regenerate keys after this migration.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.