major: kestrel is now a tak server (#6)

## Added

- CoT (Cursor on Target) server on port 8089 enabling ATAK/iTAK device connectivity
- Support for TAK stream protocol and traditional XML CoT messages
- TLS/SSL support with automatic fallback to plain TCP
- Username/password authentication for CoT connections
- Real-time device position tracking with TTL-based expiration (90s default)
- API endpoints: `/api/cot/config`, `/api/cot/server-package`, `/api/cot/truststore`, `/api/me/cot-password`
- TAK Server section in Settings with QR code for iTAK setup
- ATAK password management in Account page for OIDC users
- CoT device markers on map showing real-time positions
- Comprehensive documentation in `docs/` directory
- Environment variables: `COT_PORT`, `COT_TTL_MS`, `COT_REQUIRE_AUTH`, `COT_SSL_CERT`, `COT_SSL_KEY`, `COT_DEBUG`
- Dependencies: `fast-xml-parser`, `jszip`, `qrcode`

## Changed

- Authentication system supports CoT password management for OIDC users
- Database schema includes `cot_password_hash` field
- Test suite refactored to follow functional design principles

## Removed

- Consolidated utility modules: `authConfig.js`, `authSkipPaths.js`, `bootstrap.js`, `poiConstants.js`, `session.js`

## Security

- XML entity expansion protection in CoT parser
- Enhanced input validation and SQL injection prevention
- Authentication timeout to prevent hanging connections

## Breaking Changes

- Port 8089 must be exposed for CoT server. Update firewall rules and Docker/Kubernetes configurations.

## Migration Notes

- OIDC users must set ATAK password via Account settings before connecting
- Docker: expose port 8089 (`-p 8089:8089`)
- Kubernetes: update Helm values to expose port 8089

Co-authored-by: Madison Grubb <madison@elastiflow.com>
Reviewed-on: #6

server/utils/mediasoup.js

@@ -1,5 +1,7 @@
 import os from 'node:os'
 import mediasoup from 'mediasoup'
+import { acquire } from './asyncLock.js'
+import { MEDIASOUP_RTC_MIN_PORT, MEDIASOUP_RTC_MAX_PORT } from './constants.js'
 
 let worker = null
 const routers = new Map()
@@ -17,22 +19,25 @@ export const getWorker = async () => {
   worker = await mediasoup.createWorker({
     logLevel: process.env.NODE_ENV === 'development' ? 'debug' : 'warn',
     logTags: ['info', 'ice', 'dtls', 'rtp', 'srtp', 'rtcp'],
-    rtcMinPort: 40000,
-    rtcMaxPort: 49999,
+    rtcMinPort: MEDIASOUP_RTC_MIN_PORT,
+    rtcMaxPort: MEDIASOUP_RTC_MAX_PORT,
   })
-  worker.on('died', () => {
-    console.error('[mediasoup] Worker died, exiting')
-    process.exit(1)
+  worker.on('died', async (error) => {
+    console.error('[mediasoup] Worker died:', error?.message || String(error))
+    const { graceful } = await import('./shutdown.js')
+    await graceful(error || new Error('Mediasoup worker died'))
   })
   return worker
 }
 
 export const getRouter = async (sessionId) => {
-  const existing = routers.get(sessionId)
-  if (existing) return existing
-  const router = await (await getWorker()).createRouter({ mediaCodecs: MEDIA_CODECS })
-  routers.set(sessionId, router)
-  return router
+  return acquire(`router-${sessionId}`, async () => {
+    const existing = routers.get(sessionId)
+    if (existing) return existing
+    const router = await (await getWorker()).createRouter({ mediaCodecs: MEDIA_CODECS })
+    routers.set(sessionId, router)
+    return router
+  })
 }
 
 const isIPv4 = (host) => {
@@ -64,34 +69,36 @@ const resolveAnnouncedIp = (requestHost) => {
 }
 
 export const createTransport = async (router, requestHost = undefined) => {
-  const announcedIp = resolveAnnouncedIp(requestHost)
-  const listenIps = announcedIp
-    ? [{ ip: '0.0.0.0', announcedIp }, { ip: '127.0.0.1' }]
-    : [{ ip: '127.0.0.1' }]
+  return acquire(`transport-${router.id}`, async () => {
+    const announcedIp = resolveAnnouncedIp(requestHost)
+    const listenIps = announcedIp
+      ? [{ ip: '0.0.0.0', announcedIp }, { ip: '127.0.0.1' }]
+      : [{ ip: '127.0.0.1' }]
 
-  const transport = await router.createWebRtcTransport({
-    listenIps,
-    enableUdp: true,
-    enableTcp: true,
-    preferUdp: true,
-    initialAvailableOutgoingBitrate: 1_000_000,
-  }).catch((err) => {
-    console.error('[mediasoup] Transport creation failed:', err)
-    throw new Error(`Failed to create transport: ${err.message || String(err)}`)
+    const transport = await router.createWebRtcTransport({
+      listenIps,
+      enableUdp: true,
+      enableTcp: true,
+      preferUdp: true,
+      initialAvailableOutgoingBitrate: 1_000_000,
+    }).catch((err) => {
+      console.error('[mediasoup] Transport creation failed:', err)
+      throw new Error(`Failed to create transport: ${err.message || String(err)}`)
+    })
+
+    transports.set(transport.id, transport)
+    transport.on('close', () => transports.delete(transport.id))
+
+    return {
+      transport,
+      params: {
+        id: transport.id,
+        iceParameters: transport.iceParameters,
+        iceCandidates: transport.iceCandidates,
+        dtlsParameters: transport.dtlsParameters,
+      },
+    }
   })
-
-  transports.set(transport.id, transport)
-  transport.on('close', () => transports.delete(transport.id))
-
-  return {
-    transport,
-    params: {
-      id: transport.id,
-      iceParameters: transport.iceParameters,
-      iceCandidates: transport.iceCandidates,
-      dtlsParameters: transport.dtlsParameters,
-    },
-  }
 }
 
 export const getTransport = transportId => transports.get(transportId)