refactor(auth): replace dashboard sessions with stateless tokens and session control (#6329)

* refactor(auth): replace dashboard sessions with stateless tokens

* feat(auth): harden session issuance and distributed enforcement

* fix(proxy): preserve trusted proxy compatibility defaults

* refactor: address dashboard auth review feedback

* refactor: remove classic frontend and flatten web app

middleware/model_rate_limit_test.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestModelRedisRateLimitUsesUTCRegardlessOfLocalTimezone(t *testing.T) {
+	redisServer, redisClient := useRateLimitMiniRedis(t)
+	previousLocation := time.Local
+	time.Local = time.FixedZone("test-utc-plus-eight", 8*60*60)
+	t.Cleanup(func() { time.Local = previousLocation })
+
+	ctx := context.Background()
+	recordKey := "rateLimit:model-utc-record"
+	recordRedisRequest(ctx, redisClient, recordKey, 2)
+	recorded, err := redisClient.LIndex(ctx, recordKey, 0).Result()
+	require.NoError(t, err)
+	recordedAt, err := time.Parse(modelRateLimitTimeFormat, recorded)
+	require.NoError(t, err)
+	assert.WithinDuration(t, time.Now().UTC(), recordedAt, 2*time.Second)
+
+	checkKey := "rateLimit:model-utc-check"
+	withinWindow := time.Now().UTC().Add(-30 * time.Second).Format(modelRateLimitTimeFormat)
+	_, err = redisServer.Push(checkKey, withinWindow, withinWindow)
+	require.NoError(t, err)
+	allowed, err := checkRedisRateLimit(ctx, redisClient, checkKey, 2, 60)
+	require.NoError(t, err)
+	assert.False(t, allowed, "an existing UTC timestamp inside the window must remain limited on a non-UTC host")
+}