security: harden JWT auth with session binding, CSP headers, and sessionStorage

- Reduce access_token_ttl from 900s to 300s (5 min) to shrink XSS exploit window
- Add session_id claim to JWT tokens tied to browser session (X-Session-Id header)
- Flask middleware validates session_id matches header on every request
- CSP headers: default-src/script-src 'self', no unsafe-inline/eval, frame-ancestors none
- X-Content-Type-Options: nosniff on all responses
- Move refresh token from localStorage to sessionStorage (tab-scoped, cleared on close)
- Timing-safe password verification (dummy Argon2id for unknown users)
- WebSocket auth also validates session_id header
- Add 5 session_id tests and 3 CSP header tests

lib/db_sqlite.py

@@ -26,9 +26,11 @@ from lib.db import (
     Q_SELECT_REFRESH_TOKEN,
     Q_SELECT_USER_BY_ID,
     Q_SELECT_USER_BY_NAME,
+    Q_SELECT_USER_JWT_SECRET,
     Q_SELECT_WEBAUTHN_COUNTS,
     Q_SELECT_WEBAUTHN_ID,
     Q_SELECT_WEBAUTHN_USER,
+    Q_UPDATE_JWT_SECRET,
     Q_UPDATE_PASSWORD,
     Q_UPDATE_WEBAUTHN_SIGN_COUNT,
     Q_UPSERT_PERMISSION,
@@ -54,18 +56,20 @@ class SQLiteBackend(Database):
         # Schema init is handled by direct execution, not prepared statements
         # init_tables is called as _execute_direct(INIT_SQL)
         # Users
-        Q_INSERT_USER: ("INSERT INTO users (username, password_hash) VALUES (?, ?)"),
+        Q_INSERT_USER: ("INSERT INTO users (username, password_hash, jwt_secret) VALUES (?, ?, ?)"),
         Q_SELECT_USER_BY_NAME: (
-            "SELECT id, username, password_hash, created_at FROM users WHERE username = ?"
+            "SELECT id, username, password_hash, jwt_secret, created_at FROM users WHERE username = ?"
         ),
         Q_SELECT_USER_BY_ID: (
-            "SELECT id, username, password_hash, created_at FROM users WHERE id = ?"
+            "SELECT id, username, password_hash, jwt_secret, created_at FROM users WHERE id = ?"
         ),
         Q_UPDATE_PASSWORD: "UPDATE users SET password_hash = ? WHERE username = ?",
         Q_DELETE_USER: "DELETE FROM users WHERE username = ?",
         Q_SELECT_ALL_USERS: (
             "SELECT id, username, created_at FROM users ORDER BY username"
         ),
+        Q_SELECT_USER_JWT_SECRET: ("SELECT jwt_secret FROM users WHERE username = ?"),
+        Q_UPDATE_JWT_SECRET: ("UPDATE users SET jwt_secret = ? WHERE username = ?"),
         # Permissions
         Q_UPSERT_PERMISSION: (
             "INSERT INTO permissions (username, subsystem, level) "