feat(auth): move session auth to HttpOnly cookies

[danjdewhurst]

Summary

Implements review finding 1.8 — the auth token no longer lives in page JavaScript. The server delivers the session as an HttpOnly, SameSite=Lax cookie (Secure in production) and the SPA holds no token at all.

Server

• Set the session cookie on register/login; clear it on logout.
• readSessionToken() reads the cookie or an Authorization: Bearer header — including on the /ws upgrade, so the WebSocket authenticates from the cookie and the token no longer rides in the ws query string.
• New GET /auth/session lets the client restore a session from the cookie on load instead of reading a token from localStorage.
• Origin-aware CORS: credentialed (cookie) requests from configured origins (CORS_ALLOWED_ORIGINS, default the dev client) get that origin echoed + Access-Control-Allow-Credentials; everyone else keeps the non-credentialed wildcard. New config: corsAllowedOrigins, cookieSecure.

Client

• Every authenticated request uses credentials: "include" and drops the Authorization header — the token is never in JS.
• Session restored via GET /auth/session on load; all localStorage session storage removed. logout() clears the server cookie.
• NetClient connects without a token in the URL (the cookie carries it).
• Bonus (finding 8.6): deduped the signed-in top-bar visibility into revealSignedInChrome(), fixing the divergent edit-character reveal.

Test plan

• bun run lint ✅ · bun run typecheck ✅ · bun test ✅ 255 pass · bun run coverage:check ✅ 95.2%
• New router tests cover the Set-Cookie, /auth/session, logout-clear, and origin-aware CORS behavior; client tests updated for credentials: "include".
• Verified end-to-end in a real browser (Playwright/Chromium) against the running server + Postgres:
  • Register → Set-Cookie … HttpOnly; SameSite=Lax; document.cookie empty, localStorage empty (token unreachable by JS).
  • Reload → GET /auth/session → 200 restores the session from the cookie alone and connects the WebSocket (connected as user_…).
  • Logout → logout → 200, cookie cleared, back to the login form.

Notes

• Independent of the integration-tests PR (fix(server): Postgres integration tests + unique-violation detection bug #4) — no overlapping files; either can merge first.
• An earlier draft of this PR flagged a possible WebGL shader issue with full-body avatars. Resolved / false alarm: it only reproduces in the avatar preview harness, which creates one Pixi Application (and WebGL context) per cell — 28 contexts, past the browser's ~16 limit, so the excess get context-lost. The real app uses a single context per room and renders full-body avatars correctly (verified live). Pre-existing preview-tooling limitation, not in scope here.

🤖 Generated with Claude Code