fix(security): improve API token handling and add server-side bootstrapping

- Move token from local to session storage on client side
- Set httpOnly cookie for server-side token on bootstrap/rotate
- Add token validation and auto-sanitization
- Implement retry logic for failed operations
- Add input validation for collection names
- Update toast durations and error handling

.github/workflows/python-tests.yml

@@ -6,14 +6,18 @@ on:
   pull_request:
     branches: [ main, master ]
 
+permissions: {}
+
 jobs:
   quality:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: "3.12"
 
@@ -21,7 +25,7 @@ jobs:
         run: |
           python -m pip install --upgrade pip
           pip install -r requirements.txt
-          pip install xenon radon flake8 flake8-cognitive-complexity
+          pip install xenon radon flake8 flake8-cognitive-complexity pip-audit bandit
 
       - name: Check Python files encoding (no UTF-8 BOM)
         run: python scripts/check_no_bom.py mjr_am_backend mjr_am_shared tests __init__.py scripts
@@ -32,17 +36,31 @@ jobs:
       - name: Complexity gate (new files, CC <= 10)
         run: python scripts/check_cc_changed.py
 
+      - name: Audit Python dependencies
+        run: pip-audit --strict
+
+      - name: SAST scan (bandit)
+        run: bandit -r mjr_am_backend -ll -ii -x tests
+
+      - name: Install JS dependencies for audit
+        run: npm ci --ignore-scripts
+
+      - name: Audit JS dependencies
+        run: npm audit --audit-level=high
+
   test:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
         python-version: ["3.10", "3.12", "3.13", "3.14"]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -69,11 +87,13 @@ jobs:
 
   typecheck:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: "3.12"