[Mathieu2301]

Summary

• replace the standalone reject-all verifier with the canonical RFC 0004 Ed25519 access-token and Firebase ID-token verifier
• pin the control-plane issuer, same-origin JWKS endpoint, relay audience, Firebase project, and fixed Google certificate endpoint
• add bounded redirect-free public-key caches with exact key profiles, ETag revalidation, cache-expiry failure closure, single-flight fetches, and unknown-key refresh throttling
• bind REAUTH to the original Home Key client ID as well as the existing principal
• run the production adapter against the immutable Miakapp-V3 control-plane vector corpus in CI
• document the required public configuration and update the hardened Compose example

Security boundary

• the relay still holds no Firebase credential, Home Key, signing key, or platform secret
• public-key documents are limited to 64 KiB and 16 keys
• control-plane JWKS redirects, unknown fields, duplicate members, malformed Ed25519 keys, stale responses, and altered cache policy fail closed
• Firebase certificates remain pinned to the official Secure Token endpoint and honor its advertised max-age
• verifier errors remain redacted before reaching clients or logs

Validation

• gofmt over cmd, internal, and test
• go vet ./...
• go test -race ./...
• canonical control-plane authentication vectors, including RSA 2048/3072 Firebase profiles
• real MiakAPI-to-relay integration with successful REAUTH
• read-only live Firebase certificate endpoint shape check
• non-publishing Docker image build
• git diff --check