fix(security): consolidation & securite phase 1 (#84, BUG-021 a BUG-034)

- sanitizer XSS serveur (markdown + page de partage) [BUG-021/022]
- rate-limit/lockout MFA [BUG-023]
- isolation vaults par segments [BUG-024]
- caps regex ReDoS [BUG-025]
- SSRF webhooks + secrets externalises [BUG-026]
- rotation/revocation des jetons [BUG-027]
- politique de mot de passe + invalidation sessions [BUG-028]
- verrous users.json [BUG-029]
- IP reelle dans les audits [BUG-030]
- rate-limit par compte [BUG-031]
- symlinks hors vault ignores [BUG-032]
- recherche simple via inverted index [BUG-033]
- token en memoire + cookie HttpOnly, CSP durcie [BUG-034]

Tests: pytest 961 passed / 6 skipped, ruff 0, mypy 0, frontend vert.

tests/frontend/ai.test.mjs

@@ -1168,6 +1168,23 @@ async function main() {
     assert.ok(vaultBranch.includes("BooksLM"), "BooksLM entry present in the vault root context menu");
   });
 
+  // ── BUG-034: the access token is not persisted in sessionStorage ──
+  await test("auth token kept in memory, not in sessionStorage", async () => {
+    const authMod = await import(pathToFileURL(path.join(JS_DIR, "auth.js")).href);
+    const { AuthManager } = authMod;
+    sessionStorage.clear();
+    AuthManager.saveToken({
+      access_token: "secret-token",
+      expires_in: 3600,
+      user: { username: "u", role: "user" },
+    });
+    assert.equal(sessionStorage.getItem("obsigate_access_token"), null, "token must not be stored");
+    assert.equal(AuthManager.getToken(), "secret-token", "token available in memory");
+    assert.ok(AuthManager.hasSession(), "session detected");
+    AuthManager.clearSession();
+    assert.equal(AuthManager.getToken(), null, "session cleared");
+  });
+
   // ── Summary ──
   console.log(`\n${passCount}/${testCount} tests passed`);
   if (passCount !== testCount) {