- Stop storing discord_token and google_token in localStorage (XSS risk)
These tokens are never read, only written; backend already stores them
server-side in user data files.
- Remove discord_token and google_token from AUTH_KEYS array
- Add cookie-parser middleware to Express app
- Add setAuthCookie() helper to set JWT as HttpOnly; Secure; SameSite=Lax cookie
- Update auth routes (BIP39 register/login, Discord, Google) to set cookie
- Update getAuthIfValid() to read JWT from cookie first, then Authorization header
- Add extractJwtFromRequest() helper for dual-mode auth (cookie + header)
- Add GET /api/auth/session endpoint to rehydrate JWT from cookie on page reload
