feat(security): HttpOnly cookies + CSP headers + CSRF double-submit protection

- Migrate auth tokens from localStorage to HttpOnly SameSite=Lax cookies
- Add cookie_auth.rs: helpers for setting/clearing auth + CSRF cookies
- Update auth middleware: 3-method auth (Bearer → Basic → Cookie)
- Add 5 security headers: CSP, X-Content-Type-Options, X-Frame-Options,
  Referrer-Policy, Permissions-Policy
- Implement CSRF double-submit cookie pattern (csrf.rs middleware)
- Set CSRF cookie on login/refresh/oidc-exchange, clear on logout
- CookieAuthenticated marker skips CSRF for Bearer/Basic clients
- Frontend: strip all localStorage token refs from 14 JS files
- Frontend: csrf.js utility + all 52 mutating fetch/XHR calls protected
- 121 tests passing, 0 warnings

static/js/features/files/wopiEditor.js

@@ -60,12 +60,9 @@ class WopiEditor {
      * Fetch editor URL and WOPI token from the backend.
      */
     async _getEditorUrl(fileId, action) {
-        var token = localStorage.getItem('oxicloud_token') || '';
         var response = await fetch(
             '/api/wopi/editor-url?file_id=' + encodeURIComponent(fileId) + '&action=' + encodeURIComponent(action),
-            {
-                headers: { 'Authorization': 'Bearer ' + token }
-            }
+            { credentials: 'same-origin' }
         );
         if (!response.ok) {
             var text = await response.text();