feat: add shared PostgreSQL fnOS service and refresh UI

tests/LiveRecorder.Tests/LiveRecorder.Tests.csproj

@@ -22,6 +22,7 @@
     <ProjectReference Include="..\..\src\LiveRecorder.Application\LiveRecorder.Application.csproj" />
     <ProjectReference Include="..\..\src\LiveRecorder.Domain\LiveRecorder.Domain.csproj" />
     <ProjectReference Include="..\..\src\LiveRecorder.Infrastructure\LiveRecorder.Infrastructure.csproj" />
+    <ProjectReference Include="..\..\src\PostgresService.WebApi\PostgresService.WebApi.csproj" />
   </ItemGroup>
 
 </Project>

tests/LiveRecorder.Tests/PostgresServiceSecurityTests.cs

@@ -0,0 +1,75 @@
+using Microsoft.Extensions.Configuration;
+using PostgresService.WebApi;
+
+namespace LiveRecorder.Tests;
+
+public sealed class PostgresServiceSecurityTests : IDisposable
+{
+    private readonly string _dataRoot = Path.Combine(Path.GetTempPath(), $"postgres-service-tests-{Guid.NewGuid():N}");
+
+    [Fact]
+    public void SecretStore_PromotesSeedsAndUsesIndependentHashes()
+    {
+        Directory.CreateDirectory(_dataRoot);
+        File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
+        File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
+            })
+            .Build();
+
+        var store = new SecretStore(configuration);
+        store.EnsureInitialized();
+
+        Assert.True(store.VerifyAdminPassword("Admin-Password-For-Tests!"));
+        Assert.False(store.VerifyAdminPassword("Enrollment-Token-For-Tests-2026!"));
+        Assert.True(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
+        Assert.False(File.Exists(Path.Combine(_dataRoot, "admin-password.seed")));
+        Assert.False(File.Exists(Path.Combine(_dataRoot, "enrollment-token.seed")));
+        Assert.StartsWith("pbkdf2-sha256$", File.ReadAllText(Path.Combine(_dataRoot, "admin-password.hash")));
+    }
+
+    [Fact]
+    public void SecretStore_RotatedEnrollmentTokenInvalidatesOldToken()
+    {
+        Directory.CreateDirectory(_dataRoot);
+        File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
+        File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
+            })
+            .Build();
+        var store = new SecretStore(configuration);
+        store.EnsureInitialized();
+
+        var replacement = store.RotateEnrollmentToken();
+
+        Assert.Equal(64, replacement.Length);
+        Assert.True(store.VerifyEnrollmentToken(replacement));
+        Assert.False(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
+    }
+
+    [Fact]
+    public void AdminSessionStore_CreatesValidAndRevocableSession()
+    {
+        var sessions = new AdminSessionStore();
+        var token = sessions.Create();
+
+        Assert.True(sessions.Validate(token));
+        sessions.Revoke(token);
+        Assert.False(sessions.Validate(token));
+        Assert.False(sessions.Validate("unknown"));
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_dataRoot))
+        {
+            Directory.Delete(_dataRoot, recursive: true);
+        }
+    }
+}