security: remove reusable browser session tokens from dashboard URLs

Summary

Use the existing HttpOnly cookie as the normal dashboard session boundary and remove reusable credentials from script-visible storage and URLs. Owner surfaces: dashboard/backend/auth/middleware.go, dashboard/backend/auth/session_cookie.go, and dashboard/frontend/src/utils/authFetch.ts.

Current behavior

The dashboard accepts a reusable session credential from query strings, stores it in script-visible storage, and appends it to protected iframe, window, streaming, and socket URLs. This expands disclosure through browser and intermediary metadata and weakens the existing HttpOnly cookie control.

Expected behavior

Same-origin browser transports authenticate with HttpOnly cookies. Ordinary API routes reject query credentials, unsafe cookie-authenticated methods enforce CSRF protection, and any exceptional URL ticket is single-use, short-lived, audience-bound, and route-bound.

Acceptance

• Remove reusable session credentials from local storage, query strings, generated URLs, history, and Referer-bearing navigation.
• Remove global URL monkey-patching and rely on same-origin cookie behavior.
• Reject query credentials on ordinary API routes.
• Enforce Origin/Referer checks and CSRF tokens for unsafe methods.
• If a transport requires a URL ticket, limit it to one use, one audience/path, and a short expiry.
• Redact the legacy query field during migration.

Validation

• Add frontend tests proving fetch, iframe, window, WebSocket, and EventSource URLs contain no reusable credential.
• Add backend tests for cookie-only flows, ordinary-route query rejection, CSRF failure, one-time ticket replay, audience mismatch, and expiry.
• Run cd dashboard/backend && go test -race ./auth ./handlers ./router.
• Run cd dashboard/frontend && npm run test:unit && npm run type-check.

Related

• Parent audit: #2375
• Security index: #2357