Harden local web API token handling

[brainx]

Summary

• stop returning the per-process local API token in GET /api/health JSON
• deliver the token through an HttpOnly, SameSite=Strict cookie while retaining header authentication for configured programmatic clients
• add restrictive CSP, clickjacking, MIME-sniffing, and referrer-policy headers to all HTTP responses
• update the frontend client, regression coverage, changelog, API documentation, security notes, and threat model

Impact

The browser no longer exposes the local API token to page JavaScript or response-body consumers. State-changing same-origin requests authenticate through the cookie, and programmatic clients can continue using X-Quantum-Encryptor-Token with QUANTUM_ENCRYPTOR_API_TOKEN.

Validation

• npm run build — passed
• API client tests within npm run check — 3 passed
• remaining Vitest suites were not executed because the local workspace path contains #, which Vite resolves incorrectly
• Python tests were not executed because the local Python environment does not have the project test dependencies installed

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b20522ffbb

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bind cookie-authenticated origins to the serving port

When untrusted browser content is served from another port on the same loopback host, the browser sends this host-scoped cookie because cookie and SameSite boundaries ignore ports, while _is_allowed_origin accepts every 127.0.0.1:* or localhost:* origin. Such a page can therefore issue authenticated state-changing requests without learning the HttpOnly token, unlike the previous header-based scheme. Validate cookie-authenticated requests against the API's exact origin/port rather than any loopback port.

Useful? React with 👍 / 👎.