fix(staging): rotate SSH secret handling and env ownership

frontend/tests/database-env-validator.test.ts

@@ -192,6 +192,37 @@ test("database env validator rejects symlinks and unsafe modes", () => {
   }
 });
 
+test("database env validator enforces an explicit staging owner uid without printing values", () => {
+  const root = mkdtempSync(join(tmpdir(), "jyotisha-database-env-owner-"));
+  const envFile = join(root, ".env.staging.database");
+
+  try {
+    writeFileSync(envFile, `${validEnvironment.join("\n")}\n`, { mode: 0o600 });
+    chmodSync(envFile, 0o600);
+    const currentUid = process.getuid?.();
+    assert.equal(typeof currentUid, "number");
+
+    const accepted = spawnSync("bash", [validator, envFile], {
+      encoding: "utf8",
+      env: { ...process.env, EXPECTED_STAGING_ENV_OWNER_UID: String(currentUid) },
+    });
+    assert.equal(accepted.status, 0, accepted.stderr);
+
+    const rejected = spawnSync("bash", [validator, envFile], {
+      encoding: "utf8",
+      env: { ...process.env, EXPECTED_STAGING_ENV_OWNER_UID: String((currentUid ?? 0) + 1) },
+    });
+    assert.notEqual(rejected.status, 0);
+    assert.match(rejected.stderr, /invalid owner/);
+    assert.doesNotMatch(
+      `${rejected.stdout}${rejected.stderr}`,
+      /postgres-test-password|schema-owner-test-password|staging-backup-test-password/,
+    );
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
 test("database env validator accepts a private valid file without printing values", () => {
   const root = mkdtempSync(join(tmpdir(), "jyotisha-database-env-"));
   const envFile = join(root, ".env.staging.database");