Fix remember-me token signature forgery and expected signature leak#3

Draft

Copilot wants to merge 3 commits intomasterfrom

copilot/fix-authentication-bypass-vulnerability-another-one

Commits on Feb 18, 2026

Initial plan
Copilot
committed
Fix critical authentication bypass in remember-me token signature and remove signature leak from error messages

Copilot
and
DominicBreuker
committed
Add tests for remember-me token forgery protection and signature leak fix

Copilot
and
DominicBreuker
committed