Feat: Implement Global Master Authentication Middleware

[ArshVermaGit]

Overview

This pull request introduces a highly robust, application-wide Master Lock authentication system to mitigate the critical Missing Authentication & Authorization vulnerability.
Previously, most of the application's sensitive endpoints (e.g., file reading/writing, git operations) were completely unprotected, allowing attackers to bypass script-level locks. This architecture introduces a global security perimeter using the existing PBKDF2-HMAC-SHA256 cryptographic hashing mechanism while maintaining the UI's smooth single-page flow.

Resolved Issue

Resolves #144

Key Changes

Backend (app.py)

• Global Auth Interceptor: Added an @app.before_request hook that intercepts all traffic to /api/* (excluding the public status endpoint). If the __master__ lock exists in locks.json, the middleware validates the X-Master-Password header.
• Unauthorized Handling: Explicitly returns 401 Unauthorized with {"master_locked": true} if the authentication header is missing or incorrect.
• Status Endpoint: Introduced GET /api/master/status to allow the frontend to asynchronously verify if the application is locked.

Frontend (ui/app.js & ui/index.html)

• Global Fetch Wrapper: Wrapped window.fetch to natively and transparently inject the X-Master-Password header into every outgoing API request.
• Smart 401 Interception Loop: If the fetch wrapper receives a master_locked: true 401 response, it intercepts the promise, launches the new #master-auth-modal, waits for the user to submit the password, caches it in memory, and automatically replays the original API request without dropping any state or user actions.
• Master Lock UI: Added a global "Master Lock" icon button to the navigation header, linking to the native lock management modal so users can set, change, or remove the master password effortlessly.

Security Impact

• Severity: Critical -> Resolved
• Impact: Provides a unified, impenetrable layer of authorization across all backend routes, completely eliminating vectors for unauthenticated arbitrary file modification or unauthorized git operations.

[ArshVermaGit]

Hi @siddu-k ! Issue #144 has been resolved. Please review the PR and merge it under GSSoC. Thanks!

[ArshVermaGit]

@siddu-k conflicts are resolved please review and merge