…pin SHA, add verify-challenge

Closes 4 P0/P1 findings from the 2026-05-12 ML review:

Bug 1 (P0) — Anti-spoof `recommended_action='block'` is advisory
  AntispoofPipelineAssembler attached `recommended_action='block'` to /verify
  responses but the route still returned 200/verified=True. Added
  `ANTISPOOF_BLOCK_ENFORCE=true` (default ON in prod). When any layer votes
  block (face_usability_block, hybrid_fusion_is_spoof, or recommended_action='block')
  the route now raises HTTP 403 with `{error_code: ANTISPOOF_BLOCKED, reason: <category>}`.
  Flip flag false for canary/observation rollout. Tests:
  tests/integration/test_verify_antispoof_block_enforce.py (8 assertions, 4 for Bug 1).

Bug 2 (P0) — Blink-cache / EAR work unreachable from /verify
  The 2026-05-11 spoof-detector paper-P0 (blink cache + EAR recalibration)
  lived in `src.infrastructure.analyzers.blink_analyzer` but was never wired
  into the route. Added `_evaluate_ear_liveness_safe()` that runs MediaPipe
  FaceLandmarker on the uploaded still frame, computes EAR via the
  spoof-detector library (EAR_THRESHOLD=0.18), and vetoes on closed eyes.
  Multi-frame BlinkAnalyzer state (V-shape detection) is explicitly out of
  scope here — the cache only helps with multi-face/frame video sessions
  that the current /verify single-still-frame contract doesn't provide.
  Default OFF (ANTISPOOF_EAR_VETO_ENABLED) until ops deploys the
  face_landmarker.task asset; helper fails-soft to None when the model
  or MediaPipe is missing. Companion spoof-detector PR exposes the
  blink_analyzer module on the public `spoof_detector.*` namespace
  (per `feedback_spoof_detector_architecture`, algorithms live there).

Bug 3 (P0) — VERIFICATION_THRESHOLD_AGED semantics inverted
  Comparator is `verified = distance < threshold`; default was
  THRESHOLD=0.45, THRESHOLD_AGED=0.38 — making aged users *stricter*
  (higher FRR), the opposite of the adaptive feature's intent. Raised
  THRESHOLD_AGED default to 0.55 (still well below Facenet cosine
  operating-point ceiling ~0.6 so FAR stays controlled). Added a
  Pydantic model_validator that hard-rejects aged < standard at
  config-load — the regression cannot silently come back via env-file
  edits. .env.example documents the comparator semantics inline.
  Tests: tests/unit/test_verification_threshold_aged.py (4 assertions).

Bug 4 (P1) — Web puzzles call onSuccess client-side, no server validation
  Added POST /api/v1/liveness/verify-challenge for the web
  biometric-puzzles training surface. Single-action contract:
  `{action, start_timestamp_ms, end_timestamp_ms, confidence, ...}` →
  `{verified, action, duration_seconds, reason_code, message}`. Structural
  validation only (action enum, timestamps monotonic + sane duration
  120ms..60s, confidence floor 0.5). Heavier server-side detection
  belongs to multi-step /liveness/verify. Tests:
  tests/integration/test_verify_challenge_endpoint.py (7 assertions).
  Web-app wiring lands in a companion PR on web-app.

Bug 5 (P1) — SHA256 model integrity pins empty / advisory
  `_verify_model_integrity` previously logged a WARNING when the pin was
  empty. Added `DEEPFACE_SHA256_REQUIRED=true` (default). With this flag
  on AND ENVIRONMENT=production, an empty pin now raises RuntimeError at
  model-load — defense against silent ~/.deepface/weights/ rotations.
  Operator action: compute `sha256sum` against the in-container
  facenet512_weights.h5 and pin it via DEEPFACE_FACENET512_SHA256 in
  .env.prod (captured 2026-05-12 from running container:
  3f76b5117a9ca574d536af8199e6720089eb4ad3dc7e93534496d88265de864f).
  The face/hand_landmarker.task hashes intentionally stay empty —
  those models are NOT loaded server-side; the server only delivers
  them as static SHA256-verified assets to clients. Tests:
  tests/unit/test_deepface_sha256_required.py (5 assertions).

Test results (DATABASE_URL=postgresql://test:test@localhost:5432/test):
  - 4 new unit tests (verification_threshold_aged)
  - 5 new unit tests (deepface_sha256_required)
  - 8 new integration tests (verify_antispoof_block_enforce)
  - 7 new integration tests (verify_challenge_endpoint)
  - 6 pre-existing integration tests (verify_antispoof_wiring) — now also
    run locally thanks to added `resemblyzer` mock (baseline-rot fix).
  - test_config_validator.py — 14 pre-existing tests still green.
  Total: 44 pass / 0 fail locally.

Operator action items:
  1. Pin `DEEPFACE_FACENET512_SHA256` in /opt/projects/fivucsas/biometric-processor/.env.prod
     with the value captured above (already added to local .env.prod, NOT committed
     because .env.prod is gitignored).
  2. Rebuild biometric-processor container to pick up these changes.
  3. Decide whether to flip `ANTISPOOF_BLOCK_ENFORCE=false` for a canary rollout
     before relying on the default-ON behavior.
  4. To enable Bug 2 EAR veto: deploy `models/face_landmarker.task`, set
     `FACE_LANDMARKER_MODEL_PATH`, then `ANTISPOOF_EAR_VETO_ENABLED=true`.
  5. Add the identity-core-api proxy for `/biometric/puzzles/verify-challenge`
     when convenient — web-app soft-passes on 404 until it lands.

Memory rules respected:
  - feedback_spoof_detector_architecture: algorithms come from spoof-detector
    via the new public shim; biometric-processor only imports + wires.
  - feedback_liveness_hybrid_vs_passive: no liveness backend changes; prod
    LIVENESS_BACKEND remains as configured by ops.
  - feedback_readonly_rootfs_cache_dirs: new lazy FaceLandmarker init
    respects the existing FACE_LANDMARKER_MODEL_PATH env contract; cache
    dirs unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>