feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

- Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies
- Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies
- Update auth middleware: 3-method auth (Bearer → Basic → Cookie)
- Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy, Permissions-Policy
- Implement CSRF double-submit cookie pattern (csrf.rs middleware)
- Set CSRF cookie on login/refresh/oidc-exchange, clear on logout
- CookieAuthenticated marker skips CSRF for Bearer/Basic clients
- Frontend: strip all localStorage token refs from 14 JS files
- Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected
- 121 tests passing, 0 warnings

static/js/app/filesView.js

@@ -48,16 +48,13 @@ async function loadFiles(options = {}) {
             console.log(`Loading subfolder content: ${app.currentPath}`);
         }
 
-        const token = localStorage.getItem('oxicloud_token');
         const headers = {
             'Cache-Control': 'no-cache, no-store, must-revalidate',
             'Pragma': 'no-cache'
         };
-        if (token) {
-            headers['Authorization'] = `Bearer ${token}`;
-        }
         const requestOptions = {
             headers,
+            credentials: 'same-origin',
             cache: 'no-store'
         };