fix(web): support current Google Authenticator migration exports

[miso-develop]

Summary

Fix Web import compatibility with current Google Authenticator migration exports while preserving fail-closed parsing and the existing V1 security boundary.

Closes #128
Refs #12

Root cause

The original #12 implementation hard-coded top-level Google migration version === 1. Public current-format evidence from late 2025 shows Google Authenticator exports using version = 2 with the same established top-level MigrationPayload field numbers/types. That causes a valid current export to reach protobuf decode successfully and then be rejected by M5Authenticator's metadata validation.

Recent exports may also contain an additive OtpParameters field 8 (unique_id). The existing static protobuf decoder already ignores unknown fields safely, so this was not the rejection cause and no credential-bearing additional field is retained.

A second semantic issue was identified: batch_size is the number of QR chunks in a migration batch, not the number of accounts. The old implementation directly compared it with V1_MAX_ACCOUNTS.

Public format references used for the investigation (no user export material):

• https://blog.3n3a.ch/google-authenticator-convert-export-json-cyberchef
• Add "uniqueId" parameter to Google Authenticator .proto schema beemdevelopment/Aegis#1682
• Google Authenticator migration import (otpauth-migration:// protobuf) aaronsb/tocken#7
• https://github.com/paolostivanin/OTPClient/blob/master/src/gui/google-migration.c

Changes

• explicitly accept only known compatible Google migration versions 1 and 2
• continue rejecting arbitrary future/unknown versions
• retain existing protobuf unknown-field skipping
• validate QR batch metadata against a separate bounded QR-part limit rather than the V1 account limit
• keep the V1 maximum of 32 accounts enforced independently by MigrationBatchAssembler / ImportSession
• expose only secret-free numeric metadata (version, batchSize, batchIndex) when metadata itself is unsupported/invalid
• keep TOTP/SHA-1/6-digit/30-second V1 profile restrictions unchanged
• preserve raw/decoded secret wiping and partial-batch cleanup

Synthetic regression coverage

web/src/import/google-migration.test.ts now covers:

• current-compatible version 2 single QR
• an additive synthetic field 8 that must be ignored
• legacy version 1 compatibility
• version 2 multi-QR assembly out of order
• QR batch count semantics independent from account count
• unsupported version with secret-free diagnostics
• zero/oversized batch size and invalid batch index
• account total greater than 32
• unsupported algorithm/digits/type
• errors do not echo the source migration URI/payload
• rejected incoming secrets and discarded partial-batch secrets are zeroed

Security

• no real Google Authenticator QR, migration URI, protobuf payload, account identity, or credential was used or committed
• synthetic-only test material
• no console/log/network/persistence path added
• no dependency or lockfile change
• no firmware / Protocol / Vault format change
• no eFuse operation
• no tag or Release creation

Parallel-work evidence

• branch task/128 created from main cbb30802896e9bde81f26c12a0e3255d1436c2b7
• no open PR or concurrent Google migration implementation existed at claim time or pre-PR recheck
• changed surface is limited to web/src/import/google-migration.ts and its test

Do not merge from this implementation agent. Integration should review the exact-head CI results and security boundary before merge.

[miso-develop]

Integration handoff verification for exact head e4ee8ebf2c227e35dcb8c6af16a44a2b280fe220:

• Foundation: SUCCESS (Web tests/build, Linux Chrome smoke, Windows Chrome smoke, firmware/package baseline)
• Security: SUCCESS
• latest main unchanged from base cbb30802896e9bde81f26c12a0e3255d1436c2b7
• mergeable: true
• Web-only 2-file diff; no firmware/Protocol/Vault/dependency/eFuse/release changes
• synthetic-only migration fixtures; no real export material

Ready for Integration review. Do not merge from this implementation agent.

[miso-develop]

Integration review — APPROVE / MERGE READY

Reviewed exact head e4ee8ebf2c227e35dcb8c6af16a44a2b280fe220 against Issue #128 and current main cbb30802896e9bde81f26c12a0e3255d1436c2b7.

No blocking findings.

Security / compatibility review

• known-compatible migration versions are explicitly limited to 1 and 2; unknown versions fail closed
• batchSize is now validated as bounded QR-part metadata (1..100) rather than against the V1 account capacity
• V1 account capacity remains independently enforced at 32 via MigrationBatchAssembler and the remaining-capacity value supplied by ImportSession
• protobuf additive/unknown fields remain skipped by the unchanged static decoder (reader.skipType(...)); field 8 is neither retained nor propagated into imported account state
• unsupported/invalid metadata diagnostics contain only numeric version, batchSize, and batchIndex; no URI/Base64/raw bytes/secret/account/issuer data is included
• V1 account profile remains TOTP / SHA-1 / 6 digits / 30 seconds
• raw payload bytes and decoded protobuf secret buffers are zeroed in finally; rejected/partial batch account secrets are also cleared on mismatch/limit paths
• changed files are exactly the Web importer and its test; no runtime network, persistence, dependency/lockfile, firmware, Protocol, Vault format, release, or eFuse changes

Exact-head verification

• Foundation #618: SUCCESS
  • Web tests/build: SUCCESS
  • Linux Chrome QR production smoke: SUCCESS
  • Windows Chrome QR production smoke: SUCCESS
  • firmware build/package baseline: SUCCESS
  • Web/firmware dependency lockfiles unchanged
• Security #621: SUCCESS
• unresolved review threads: none
• PR mergeable: true
• main still equals the PR base SHA

Integration decision: merge approved. Squash merge is appropriate for this scoped fix.