Block guest accounts from web UI login

The web UI now validates the MCIAS token after login and rejects
accounts with the guest role before setting the session cookie.
This is defense-in-depth alongside the env:restricted MCIAS tag.

The webserver.New() constructor takes a new ValidateFunc parameter
that inspects token roles post-authentication. MCIAS login does not
return roles, so this requires an extra ValidateToken round-trip at
login time (result is cached for 30s).

Security: guest role accounts are denied web UI access

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/webserver/server.go

@@ -21,16 +21,20 @@ import (
 // LoginFunc authenticates a user and returns a bearer token.
 type LoginFunc func(username, password string) (token string, expiresIn int, err error)
 
+// ValidateFunc validates a bearer token and returns the user's roles.
+type ValidateFunc func(token string) (roles []string, err error)
+
 // Server is the MCR web UI server.
 type Server struct {
-	router    chi.Router
-	templates *templateSet
-	registry  mcrv1.RegistryServiceClient
-	policy    mcrv1.PolicyServiceClient
-	audit     mcrv1.AuditServiceClient
-	admin     mcrv1.AdminServiceClient
-	loginFn   LoginFunc
-	csrfKey   []byte // 32-byte key for HMAC signing
+	router     chi.Router
+	templates  *templateSet
+	registry   mcrv1.RegistryServiceClient
+	policy     mcrv1.PolicyServiceClient
+	audit      mcrv1.AuditServiceClient
+	admin      mcrv1.AdminServiceClient
+	loginFn    LoginFunc
+	validateFn ValidateFunc
+	csrfKey    []byte // 32-byte key for HMAC signing
 }
 
 // New creates a new web UI server with the given gRPC clients and login function.
@@ -40,6 +44,7 @@ func New(
 	audit mcrv1.AuditServiceClient,
 	admin mcrv1.AdminServiceClient,
 	loginFn LoginFunc,
+	validateFn ValidateFunc,
 	csrfKey []byte,
 ) (*Server, error) {
 	tmpl, err := loadTemplates()
@@ -48,13 +53,14 @@ func New(
 	}
 
 	s := &Server{
-		templates: tmpl,
-		registry:  registry,
-		policy:    policy,
-		audit:     audit,
-		admin:     admin,
-		loginFn:   loginFn,
-		csrfKey:   csrfKey,
+		templates:  tmpl,
+		registry:   registry,
+		policy:     policy,
+		audit:      audit,
+		admin:      admin,
+		loginFn:    loginFn,
+		validateFn: validateFn,
+		csrfKey:    csrfKey,
 	}
 
 	s.router = s.buildRouter()