feat: Sprint 2 — Wursor-side pairing flow + signed plugin client

- session store + requireSession middleware (signup persists session)
- PairingService (8-char code, 5-min TTL, 5-attempt lockout, single-use, https check)
- POST /sites/pair, /sites/redeem, /sites/:id/confirm, GET /sites/:id
- PluginClient signs HMAC (timestamp+method+path+body-hash), token in Authorization
- ADR 0016; 58 api tests green

api/__tests__/services/pairing-service.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect } from 'vitest';
+import { PairingService } from '../../src/services/pairing-service.ts';
+
+describe('PairingService', () => {
+  it('issues an 8-char code with a 5-minute expiry', () => {
+    const svc = new PairingService({ now: () => 1_000_000 });
+    const { code, expiresAt } = svc.issue('acct-1');
+    expect(code).toMatch(/^[A-Z0-9]{8}$/);
+    expect(expiresAt).toBe(1_000_000 + 5 * 60 * 1000);
+  });
+
+  it('redeems a valid code once and returns distinct scoped tokens', () => {
+    const svc = new PairingService({ now: () => 1_000_000 });
+    const { code } = svc.issue('acct-1');
+    const result = svc.redeem(code, 'https://example.com');
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.accountId).toBe('acct-1');
+      expect(result.readToken).toBeTruthy();
+      expect(result.deployToken).toBeTruthy();
+      expect(result.hmacSecret).toBeTruthy();
+      expect(result.readToken).not.toBe(result.deployToken);
+    }
+  });
+
+  it('rejects a second redeem of the same code', () => {
+    const svc = new PairingService({ now: () => 1_000_000 });
+    const { code } = svc.issue('acct-1');
+    svc.redeem(code, 'https://example.com');
+    expect(svc.redeem(code, 'https://example.com')).toEqual({ ok: false, error: 'consumed' });
+  });
+
+  it('expires a code after five minutes', () => {
+    let t = 1_000_000;
+    const svc = new PairingService({ now: () => t });
+    const { code } = svc.issue('acct-1');
+    t += 5 * 60 * 1000 + 1;
+    expect(svc.redeem(code, 'https://example.com')).toEqual({ ok: false, error: 'expired' });
+  });
+
+  it('locks a code after five failed attempts', () => {
+    const svc = new PairingService({ now: () => 1_000_000 });
+    const { code } = svc.issue('acct-1');
+    for (let i = 0; i < 5; i += 1) {
+      svc.redeem(code, 'http://insecure.example.com');
+    }
+    expect(svc.redeem(code, 'https://example.com')).toEqual({ ok: false, error: 'locked' });
+  });
+
+  it('rejects a non-https site URL as an invalid attempt', () => {
+    const svc = new PairingService({ now: () => 1_000_000 });
+    const { code } = svc.issue('acct-1');
+    expect(svc.redeem(code, 'http://insecure.example.com')).toEqual({ ok: false, error: 'invalid' });
+  });
+
+  it('returns invalid for an unknown code', () => {
+    expect(new PairingService().redeem('NOPE0000', 'https://example.com')).toEqual({ ok: false, error: 'invalid' });
+  });
+});

api/__tests__/services/plugin-client.test.ts

@@ -0,0 +1,59 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { createHash, createHmac } from 'node:crypto';
+import { PluginClient } from '../../src/services/plugin-client.ts';
+
+let fetchMock: ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+  fetchMock = vi.fn();
+  vi.stubGlobal('fetch', fetchMock);
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+const creds = { siteUrl: 'https://example.com', readToken: 'r-token', hmacSecret: 'h-secret' };
+
+function expectedSignature(secret: string, timestamp: string, method: string, path: string, body: string): string {
+  const canonical = `${timestamp}\n${method}\n${path}\n${createHash('sha256').update(body).digest('hex')}`;
+  return createHmac('sha256', secret).update(canonical).digest('hex');
+}
+
+describe('PluginClient', () => {
+  it('signs requests and sends the token in Authorization, never the URL', async () => {
+    fetchMock.mockResolvedValue({ ok: true, json: async () => ({ theme: 'twentytwentyfour' }) });
+    const client = new PluginClient(creds);
+
+    await client.get('/site-info');
+
+    const [url, init] = fetchMock.mock.calls[0] as [string, { headers: Record<string, string> }];
+    expect(url).toBe('https://example.com/wp-json/wursor/v1/site-info');
+    expect(String(url)).not.toContain('r-token');
+    expect(init.headers.Authorization).toBe('Bearer r-token');
+    expect(init.headers['X-Wursor-Timestamp']).toBeTruthy();
+    expect(init.headers['X-Wursor-Signature']).toMatch(/^[0-9a-f]{64}$/);
+  });
+
+  it('computes the HMAC over timestamp + method + path + body hash', async () => {
+    fetchMock.mockResolvedValue({ ok: true, json: async () => ({}) });
+    const client = new PluginClient(creds);
+
+    await client.post('/files', { a: 1 });
+
+    const [, init] = fetchMock.mock.calls[0] as [string, { headers: Record<string, string> }];
+    const ts = init.headers['X-Wursor-Timestamp'];
+    expect(init.headers['X-Wursor-Signature']).toBe(expectedSignature('h-secret', ts, 'POST', '/files', '{"a":1}'));
+  });
+
+  it('maps a 401 to Authentication failed', async () => {
+    fetchMock.mockResolvedValue({ ok: false, status: 401 });
+    const client = new PluginClient(creds);
+
+    await expect(client.get('/site-info')).rejects.toThrow('Authentication failed');
+  });
+
+  it('refuses to construct a client with an http:// site URL', () => {
+    expect(() => new PluginClient({ ...creds, siteUrl: 'http://example.com' })).toThrow();
+  });
+});