[PHASE-5.2] Harden trial proxy against abuse

[matthewod11-stack]

Description

Trial proxy accepts requests with limited verification, enabling potential quota bypass and cost abuse via scripted requests.

Current State

• Origin allowlist and coarse per-IP throttling implemented
• Trial usage headers (X-Trial-Used, X-Trial-Limit) added
• Optional HMAC signature verification and replay protection added
• Remaining: Final hardening depends on production TRIAL_SIGNING_SECRET configuration in Worker secrets and matching desktop app config
• Files: proxy/ (Cloudflare Worker), src-tauri/src/ (desktop app config)

Suggested Fix

• Configure TRIAL_SIGNING_SECRET in Cloudflare Worker secrets
• Verify HMAC signature enforcement is active in production
• Test replay protection with real traffic
• Confirm per-IP throttle thresholds are reasonable

Verification

• cargo test --manifest-path src-tauri/Cargo.toml passes
• Manual test: scripted requests without valid signature are rejected
• Manual test: replayed requests are rejected

Automation Hints

scope: proxy/
do-not-touch: src/components/
approach: config-change
risk: medium
max-files-changed: 3
blocked-by: none
bail-if: proxy stops accepting legitimate trial requests

Priority

Medium