Python Lab 4 -- Break the Repeating-Key XOR

A challenge/response CTF. Connect, and you're handed one message encrypted
with a fresh random repeating-key XOR key (2-10 bytes) that is never sent
to you and is discarded immediately after encryption. Recover the cleartext
and send it back within 5 seconds to get the flag.

Encryption pipeline is cleartext -> XOR -> Base64, so reversing it means
Base64-decoding first, then attacking the XOR.

ENDPOINTS

  GET /healthz
      Health check. Replies with the text "ok" and nothing else. Use it to
      confirm you can reach the server before attempting the challenge.

  POST /connect
      Send an empty body. Starts a session.
      Response body:    Base64(XOR(message, key)) as plain text.
      Response headers: X-Session-Id -- your session identifier, needed below.
                        X-Time-Limit-Seconds -- how long you have to answer.

  POST /respond
      Send the decrypted cleartext as the RAW request body -- do NOT Base64
      encode your answer, the encoding is not symmetric.
      Required header: X-Session-Id, the value from your /connect response.
      200 -> body is the flag.
      400 -> unknown, expired, or already-used session id.
      403 -> wrong answer.
      408 -> your answer arrived later than 5 seconds after /connect.

NOTES

  Each session id is good for exactly one answer, right or wrong. Ask for a
  new one with /connect. Unanswered sessions are pruned after 60
  seconds. Every /connect gets an independent key and message, so the key
  and the key length cannot be hard-coded.