security: harden JWT auth with session binding, CSP headers, and sessionStorage

- Reduce access_token_ttl from 900s to 300s (5 min) to shrink XSS exploit window
- Add session_id claim to JWT tokens tied to browser session (X-Session-Id header)
- Flask middleware validates session_id matches header on every request
- CSP headers: default-src/script-src 'self', no unsafe-inline/eval, frame-ancestors none
- X-Content-Type-Options: nosniff on all responses
- Move refresh token from localStorage to sessionStorage (tab-scoped, cleared on close)
- Timing-safe password verification (dummy Argon2id for unknown users)
- WebSocket auth also validates session_id header
- Add 5 session_id tests and 3 CSP header tests

webui/static/hoover/websocket.js

@@ -22,7 +22,7 @@ const _directHandlers = [];
  * @returns {Promise<boolean>} true if token was refreshed
  */
 async function _tryRefreshToken() {
-    const refresh = localStorage.getItem('vw:refresh');
+    const refresh = sessionStorage.getItem('vw:refresh');
     if (!refresh) return false;
     try {
         const res = await fetch('/api/auth/refresh', {
@@ -36,9 +36,15 @@ async function _tryRefreshToken() {
         if (!json.ok || !json.data?.tokens) return false;
         const tokens = json.data.tokens;
         window.__auth_token__ = tokens.access_token;
-        localStorage.setItem('vw:refresh', tokens.refresh_token);
-        localStorage.setItem('vw:access_ttl', String((json.data.access_ttl || 900) * 1000));
-        localStorage.setItem('vw:user', JSON.stringify(json.data.user));
+        sessionStorage.setItem('vw:refresh', tokens.refresh_token);
+        sessionStorage.setItem('vw:access_ttl', String((json.data.access_ttl || 300) * 1000));
+        if (tokens.session_id) {
+            sessionStorage.setItem('vw:session_id', tokens.session_id);
+        }
+        if (json.data.user) {
+            sessionStorage.setItem('vw:user', JSON.stringify(json.data.user));
+            localStorage.setItem('vw:user', JSON.stringify(json.data.user));
+        }
         return true;
     } catch {
         return false;