feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

internal/webapp/auth_password.go

@@ -0,0 +1,45 @@
+package webapp
+
+import (
+	"fmt"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// bcryptCost is the work factor for new bcrypt hashes. Matches the
+// "cost 12" assumption from docs/distributed/worker-web-app.md
+// section 5.2; the cost applies to first-run and password-change
+// hashes alike.
+const bcryptCost = 12
+
+// HashPassword bcrypts the given plaintext password at the package's
+// configured cost. Returns the encoded hash ready to be persisted.
+func HashPassword(plain string) (string, error) {
+	if plain == "" {
+		return "", fmt.Errorf("webapp: empty password")
+	}
+	h, err := bcrypt.GenerateFromPassword([]byte(plain), bcryptCost)
+	if err != nil {
+		return "", fmt.Errorf("webapp: bcrypt hash: %w", err)
+	}
+	return string(h), nil
+}
+
+// VerifyPassword reports whether the given plaintext matches the
+// given bcrypt hash. A nil error means the password is correct.
+func VerifyPassword(hash, plain string) error {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(plain))
+}
+
+// MaskToken returns the last 4 characters of a token prefixed with a
+// star mask, e.g. "****abcd". Empty input yields "—". Used on the
+// settings page where the worker's bearer token is shown read-only.
+func MaskToken(token string) string {
+	if token == "" {
+		return "—"
+	}
+	if len(token) <= 4 {
+		return "****"
+	}
+	return "****" + token[len(token)-4:]
+}