Harden for public launch: rate limiting, CORS, error display, Gitea webhook sig

- User::login() locks an account for 15 min after 5 failed attempts
- CORS now restricted to an explicit origin whitelist instead of *
- display_errors disabled in production (errors still logged server-side)
- webhook.php now checks Gitea's actual signature header (X-Gitea-Signature,
  raw hex) instead of GitHub's format, which never matched on this Gitea instance

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

webhook.php

@@ -14,8 +14,10 @@ $database = new Database();
 $secret = $database->webhook_secret;
 
 $payload = file_get_contents('php://input');
-$signatureHeader = $_SERVER['HTTP_X_HUB_SIGNATURE_256'] ?? '';
-$expectedSignature = 'sha256=' . hash_hmac('sha256', $payload, $secret);
+// Gitea (auto-hébergé) envoie un hex brut dans X-Gitea-Signature, sans préfixe "sha256="
+// (contrairement à GitHub qui utilise X-Hub-Signature-256 avec le préfixe)
+$signatureHeader = $_SERVER['HTTP_X_GITEA_SIGNATURE'] ?? '';
+$expectedSignature = hash_hmac('sha256', $payload, $secret);
 
 // Comparaison en temps constant pour éviter les attaques par timing
 if (!$signatureHeader || !hash_equals($expectedSignature, $signatureHeader)) {