[chogarcia]

Audit 2026-10-02, Batch R: web and mobile pin "this account is v2"; the CLI obeyed any server authVersion: 1 answer and posted the raw password.

Before: /api/auth/salt answering version 1 (tampered server, or an account downgraded via a stolen session) made sf login/push/sync send the raw password.

After:

• After a sign-in that sent only the login secret, the account is recorded in ~/.shieldfive/auth-pins.json (SHA-256 of the lower-cased email, file 0600, dir 0700 via ensurePrivateDir, write-then-rename).
• For a pinned account, a version-1 answer (migration on or off) throws LegacyLoginRefusedError (code: legacy_login_refused) before anything but the salt lookup is sent.
• --allow-legacy-login on sf login, sf push, sf sync overrides; the pin is kept afterwards.
• A failed pin write does not fail sign-in. An unreadable/corrupt pin file reads as no pins and is replaced on next write.
• signIn() takes optional authPin / allowLegacyLogin; library callers without authPin behave as before.

Tests: new test/auth.pin.test.mjs (8). npm test: 144/144 pass.

Not published; release is the founder's call. CHANGELOG has an Unreleased entry.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}