fix(security): consolidation & securite phase 1 (#84, BUG-021 a BUG-034)

- sanitizer XSS serveur (markdown + page de partage) [BUG-021/022]
- rate-limit/lockout MFA [BUG-023]
- isolation vaults par segments [BUG-024]
- caps regex ReDoS [BUG-025]
- SSRF webhooks + secrets externalises [BUG-026]
- rotation/revocation des jetons [BUG-027]
- politique de mot de passe + invalidation sessions [BUG-028]
- verrous users.json [BUG-029]
- IP reelle dans les audits [BUG-030]
- rate-limit par compte [BUG-031]
- symlinks hors vault ignores [BUG-032]
- recherche simple via inverted index [BUG-033]
- token en memoire + cookie HttpOnly, CSP durcie [BUG-034]

Tests: pytest 961 passed / 6 skipped, ruff 0, mypy 0, frontend vert.

frontend/js/admin.js

@@ -28,17 +28,12 @@ let _auditFilters = { user: "", action: "" };
 // ── Helpers ──────────────────────────────────────────────────────────────
 
 /**
- * Read the current Bearer token from sessionStorage (same key auth.js uses).
- * Returns an `{Authorization: "Bearer ..."}` object or null.
+ * BUG-034: the access token now lives in an HttpOnly cookie (and in memory
+ * inside auth.js), never in sessionStorage.  Same-origin requests carry the
+ * cookie automatically, so no Authorization header is needed here.
  */
 export function getAuthHeaders() {
-  try {
-    const token = sessionStorage.getItem("obsigate_access_token");
-    if (!token) return null;
-    return { Authorization: "Bearer " + token };
-  } catch {
-    return null;
-  }
+  return null;
 }
 
 /** Format a size in MB as a human-readable string. */