fix(security): resolve CodeQL hard-coded-crypto alerts in portal auth

[chinkan]

What

Resolves CodeQL rust/hard-coded-cryptographic-value alerts #22 and #23 in src/portal/auth.rs.

Root cause

signing_secret() materialised the 32-byte HMAC signing key from a zero-initialised [0u8; 32] buffer on both paths:

Line	Path	Old code
136	read portal_secret.key	let mut buf = [0u8; 32]; hex_decode_32(..., &mut buf)
143	create key	let mut buf = [0u8; 32]; fill_bytes(&mut rng, &mut buf)

The constant value flows into Hmac::<Sha256>::new_from_slice(...) (auth.rs:240 / :255), so CodeQL flags it as a hard-coded key. The values were always overwritten first — this is a false positive in practice, but the pattern is what the rule is designed to catch, and it is trivially avoidable.

Fix (same proven pattern as PR #100)

• hex_decode_32(raw) -> Option<[u8; 32]> now parses into a fresh Vec<u8> then <[u8;32]>::try_from(...) — the key is never materialised from a constant-initialised buffer.
• the create path draws the key directly from the OS CSPRNG with rand::rng().random().

Behaviour is identical: same 32-byte key, same on-disk hex format, same corrupt-file rejection, cookies still stable across restarts.

Verification

Check	Result
cargo fmt	clean
cargo clippy --all-targets -- -D warnings	clean
cargo test	792 passed / 0 failed
portal::auth unit tests	6/6 (incl. hex_decode_32_roundtrip, cookie_sign_verify_roundtrip_and_tamper)
tests/portal_api.rs	62/62 (incl. cookie_survives_new_state_same_home)

CodeQL will re-scan this PR ref; expected rust findings drop from 5 → 3 (the 3 test-only alerts remain and are dismissed separately).

Related

• Alerts Claude/agent skills personality oof jq #22 / docs: update CLAUDE.md with subagent tool whitelist details and clari… #23 (production, fixed here)
• Alerts docs: add subagent model selection design doc and implementation plan #21 / Add LangSmith tracking loggin #24 / Add agents/ layer: invoke_agent, read/write_agent_file, reload_agents tools #25 are test-only fixtures ([9u8;32], [4u8;32], tempdir path) — dismissed separately with reason "used in tests".