Migrate Browser Authentication to Secure HttpOnly Cookies

[llinsss]

Problem

Browser-accessible bearer-token storage increases token theft impact from XSS and complicates refresh/revocation behavior.

Scope

• Use Secure, HttpOnly, SameSite cookies for session/refresh tokens.
• Add CSRF protection for state-changing requests.
• Migrate existing sessions with a bounded compatibility period.

Acceptance Criteria

• JavaScript cannot read session credentials.
• Cross-site state-changing requests fail CSRF validation.
• Logout and refresh revoke/rotate server-side session state.

---