9 new commits pushed to

<https://github.com/jmpsec/osctrl/tree/main|main>

by javuto

<https://github.com/jmpsec/osctrl/commit/8257e5410c37c5ea99dace51335c79d40bba302c|8257e541>

- osctrl-api: RootHandler 404s on misrouted GETs

<https://github.com/jmpsec/osctrl/commit/8d736da01a65e23a4508ebf283cb6e54e421e338|8d736da0>

- pkg/users: close username-enumeration timing leak on CheckLoginCredentials

<https://github.com/jmpsec/osctrl/commit/528f56547e05903d67ef1e646bf0157721921f86|528f5654>

- ratelimit: key on TCP peer, not X-Forwarded-For (close XFF rate-limit bypass)

<https://github.com/jmpsec/osctrl/commit/ae968f5c30ae6bf4895c365615568726366c8cba|ae968f5c>

- osctrl-api: require auth on /queries/samples and /carves/samples

<https://github.com/jmpsec/osctrl/commit/136b769dfa984e3c94f5a402a896da0be02b18e4|136b769d>

- deploy/nginx: server_tokens off — strip version from Server header

<https://github.com/jmpsec/osctrl/commit/2396dbdf7b850305ba7e683c6c4c02cc40cd8b22|2396dbdf>

- osctrl-admin: disable autoindex on /static/ via noDirListing wrapper

<https://github.com/jmpsec/osctrl/commit/09f9480f48a73bc211a8b65270dc548904d17768|09f9480f>

- pkg/users: stamp random jti on every JWT to make rotation real

<https://github.com/jmpsec/osctrl/commit/3baf9e876c6044ae54b38642962136f3533ea983|3baf9e87>

- osctrl-api: rotate JWT on every login (drop reuse-when-fresh branch)

<https://github.com/jmpsec/osctrl/commit/064f5b62971b915dec63fed3604ff2d1270a449e|064f5b62>

- Merge pull request #826 from alvarofraguas/pr/security-hardening jmpsec/osctrl