feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

- Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies
- Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies
- Update auth middleware: 3-method auth (Bearer → Basic → Cookie)
- Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy, Permissions-Policy
- Implement CSRF double-submit cookie pattern (csrf.rs middleware)
- Set CSRF cookie on login/refresh/oidc-exchange, clear on logout
- CookieAuthenticated marker skips CSRF for Bearer/Basic clients
- Frontend: strip all localStorage token refs from 14 JS files
- Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected
- 121 tests passing, 0 warnings

static/js/app/userMenu.js

@@ -224,18 +224,16 @@ function showUserProfileModal() {
 }
 
 function logout() {
-    const TOKEN_KEY = 'oxicloud_token';
-    const REFRESH_TOKEN_KEY = 'oxicloud_refresh_token';
-    const TOKEN_EXPIRY_KEY = 'oxicloud_token_expiry';
     const USER_DATA_KEY = 'oxicloud_user';
 
-    localStorage.removeItem(TOKEN_KEY);
-    localStorage.removeItem(REFRESH_TOKEN_KEY);
-    localStorage.removeItem(TOKEN_EXPIRY_KEY);
-    localStorage.removeItem(USER_DATA_KEY);
-
-    sessionStorage.removeItem('redirect_count');
-    window.location.href = '/login';
+    // Tell the server to clear HttpOnly cookies
+    fetch('/api/auth/logout', { method: 'POST', credentials: 'same-origin', headers: getCsrfHeaders() })
+        .catch(() => {}) // Best-effort
+        .finally(() => {
+            localStorage.removeItem(USER_DATA_KEY);
+            sessionStorage.removeItem('redirect_count');
+            window.location.href = '/login';
+        });
 }
 
 window.setupUserMenu = setupUserMenu;