fix(auth): remove JS-readable token persistence and use HttpOnly session cookie

[KinshukSS2]

Summary

This PR hardens authentication token handling by removing browser-script-readable token persistence and moving session token management to server-side HttpOnly cookies.

What changed

• Removed token persistence in browser localStorage.
• Removed client-side token cookie writes (httpOnly: false pattern).
• Added server-side auth cookie lifecycle (login, logout, refresh) using HttpOnly cookie flags.
• Refactored client auth context to session-state semantics (authenticated, username, loading) without exposing bearer token to browser code paths.
• Updated service auth-header resolution to read token server-side from cookies when explicit token is absent.

Security outcome

• localStorage.getItem('token') no longer returns a bearer token.
• Token cookie is now server-managed and HttpOnly.
• Client-side scripts can no longer directly read bearer token values.

Files touched

• ui/context/AuthContext.tsx
• ui/features/auth/components/Login.tsx
• ui/components/layout/Navbar.tsx
• ui/app/Home.tsx
• ui/features/forms/components/FormModal.tsx
• ui/services/auth.ts
• ui/services/fetch.ts
• ui/services/things.ts
• ui/services/locations.ts
• ui/services/sensors.ts
• ui/services/datastreams.ts
• ui/services/observedProperties.ts
• SECURITY_PROBLEM_004_auth_token_exposure.md

Validation

• Build succeeds: npm run build in ui.
• Security grep confirms no client token storage/cookie write patterns remain under ui.

fix #28