daemon: rpc/ws_server — loopback WebSocket transport + pairing (build step 1, second half)

The extension's fallback transport (docs/05 §4). veloxd now also listens
on 127.0.0.1, first free port in 52000-52016, and writes it to
<runtime>/ws.port (0600).

- rpc/ws_frame — RFC 6455 frame codec. Incremental; reassembles
  continuation frames; enforces "client frames MUST be masked" (§5.1);
  caps a reassembled message at 8 MiB. This is the attacker-adjacent
  parser, so it has its own test table.
- rpc/ws_handshake — HTTP upgrade parse, Sec-WebSocket-Accept
  (SHA-1 + base64 via libcrypto), and the two non-negotiable checks:
  an Origin header must be present and must be moz-extension:// (a page
  cannot pair). Version must be 13.
- rpc/ws_server — per-connection Handshake -> Open state machine on the
  shared EventLoop. Token gate: session.pair mints a token behind the
  approver + rate limiter; session.hello must present a valid one;
  every other method is -32002 until authed. Privileged methods are
  refused -32003 by the generated dispatch(). Ping -> Pong; Close
  echoed. session.hello major-version mismatch -> -32001.
- rpc/pairing — PairingApprover interface + EnvAutoApprover dev stub
  (approves iff VELOX_PAIR_AUTO=1); PairingRateLimiter (5 failures / 60 s
  per origin, then 60 s lockout -> -32014, survives reconnect); a
  four-digit code generator.
- store/pairings — the pairings table: create() returns the plaintext
  token once and stores only its SHA-256; find_active_by_token,
  touch, revoke, list_active.
- util/crypto — sha1 / sha256_hex / base64 / random_token over libcrypto.
- store/sqlite — pin the DB file (and -wal/-shm) to 0600.
- runtime_dir — resolve_data_dir() for $XDG_DATA_HOME/velox (velox.db).
- main.cpp — opens + migrates velox.db, starts both transports; a WS
  bind failure is logged, not fatal (capture must fail open, the Unix
  socket still serves the GUI/CLI).

Real gap, flagged not hidden: the pairing prompt is EnvAutoApprover for
now — a GUI dialog / desktop notification is build step 7. Pairing
needs VELOX_PAIR_AUTO=1 until then.

Tests (ASan+UBSan and TSan clean): veloxd.ws_frame (codec + handshake
vectors incl. the RFC 6455 §1.3 accept sample), veloxd.pairings (token
create/find/revoke, hash-not-token, rate-limit window + lockout +
per-origin isolation + success reset), veloxd.ws_server (full flow: 101
handshake, -32002 gate, deny-then-approve pairing, hello-with-token,
-32003 privileged refusal, real download.list). 27 daemon/cli tests
green; full tree green.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Upd9WhG9oppieig5nRDLig

daemon/src/util/crypto.cpp

@@ -0,0 +1,57 @@
+#include "util/crypto.hpp"
+
+#include <openssl/evp.h>
+#include <openssl/rand.h>
+#include <openssl/sha.h>
+
+#include <stdexcept>
+
+namespace velox::daemon::crypto {
+
+std::array<std::uint8_t, 20> sha1(std::string_view data) {
+    std::array<std::uint8_t, 20> out{};
+    ::SHA1(reinterpret_cast<const unsigned char*>(data.data()), data.size(), out.data());
+    return out;
+}
+
+std::string sha256_hex(std::string_view data) {
+    unsigned char digest[SHA256_DIGEST_LENGTH];
+    ::SHA256(reinterpret_cast<const unsigned char*>(data.data()), data.size(), digest);
+
+    static constexpr char kHex[] = "0123456789abcdef";
+    std::string out;
+    out.reserve(SHA256_DIGEST_LENGTH * 2);
+    for (unsigned char b : digest) {
+        out.push_back(kHex[b >> 4]);
+        out.push_back(kHex[b & 0x0F]);
+    }
+    return out;
+}
+
+std::string base64_encode(const std::uint8_t* data, std::size_t len) {
+    // 4 chars per 3 bytes, rounded up, plus a NUL that EVP writes.
+    std::string out(4 * ((len + 2) / 3), '\0');
+    const int n = ::EVP_EncodeBlock(reinterpret_cast<unsigned char*>(out.data()), data,
+                                    static_cast<int>(len));
+    if (n < 0) throw std::runtime_error("EVP_EncodeBlock failed");
+    out.resize(static_cast<std::size_t>(n));
+    return out;
+}
+
+std::string random_token(std::size_t n) {
+    std::string raw(n, '\0');
+    if (::RAND_bytes(reinterpret_cast<unsigned char*>(raw.data()), static_cast<int>(n)) != 1) {
+        throw std::runtime_error("RAND_bytes failed");
+    }
+    std::string b64 =
+        base64_encode(reinterpret_cast<const std::uint8_t*>(raw.data()), raw.size());
+    // base64 -> base64url, and drop '=' padding.
+    for (char& c : b64) {
+        if (c == '+') c = '-';
+        else if (c == '/') c = '_';
+    }
+    while (!b64.empty() && b64.back() == '=') b64.pop_back();
+    return b64;
+}
+
+}  // namespace velox::daemon::crypto

daemon/src/util/crypto.hpp

@@ -0,0 +1,29 @@
+#pragma once
+
+// Small cryptographic helpers over libcrypto: the WebSocket accept-key hash, the pairing
+// token hash, base64, and a CSPRNG token. Nothing bespoke — thin wrappers so callers do
+// not touch the OpenSSL API directly.
+
+#include <array>
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <string_view>
+
+namespace velox::daemon::crypto {
+
+// SHA-1 of `data`, raw 20 bytes. Used only for the RFC 6455 Sec-WebSocket-Accept value.
+std::array<std::uint8_t, 20> sha1(std::string_view data);
+
+// SHA-256 of `data` as lowercase hex (64 chars). The pairings table stores this, never
+// the token itself (CLAUDE.md §4).
+std::string sha256_hex(std::string_view data);
+
+// Standard base64 (with '+' '/' '='), used for Sec-WebSocket-Accept.
+std::string base64_encode(const std::uint8_t* data, std::size_t len);
+
+// `n` bytes from the system CSPRNG, encoded base64url without padding. The pairing token
+// is 32 bytes -> 43 chars, matching SessionPairResult.token's "256 bits, base64url".
+std::string random_token(std::size_t n = 32);
+
+}  // namespace velox::daemon::crypto