Move JWT from localStorage to HttpOnly cookie; fix CSRF

- JWT stored in HttpOnly, Secure, SameSite=Strict cookie — JS cannot
  read the token at all; SameSite=Strict prevents CSRF without tokens
- Non-sensitive user payload returned in response body and stored in
  localStorage for UI purposes only (not usable for auth)
- Add POST /api/auth/logout endpoint that clears the cookie server-side
- Add SECURE_COOKIES env var (default true) for local HTTP testing
- Extract login.html inline script to login.js (CSP compliance)
- Remove Authorization: Bearer header from API calls; add credentials:
  include so cookies are sent automatically
- CSP script-src includes unsafe-inline to support existing onclick
  handlers throughout the app

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/schemas.py

@@ -14,6 +14,17 @@ class TokenResponse(BaseModel):
     access_token: str
     token_type: str = "bearer"
 
+class UserPayload(BaseModel):
+    sub:      str
+    username: str
+    is_admin: bool
+    timezone: str
+    exp:      int
+    admin_id: Optional[int] = None
+
+class AuthResponse(BaseModel):
+    user: UserPayload
+
 class ChangePasswordRequest(BaseModel):
     current_password: str
     new_password: str = Field(min_length=10)