Authenticate browser media with durable HttpOnly login cookies

Adapted cookie, origin, URL validation and secret handling from MikaelKW/nodecast-tv-plus. Protect API roles, revoke logins across restart, preserve existing accounts, and isolate transcode sessions by account.

Co-authored-by: Mikael <mikaelkwessel@gmail.com>

public/login.html

@@ -299,7 +299,7 @@
                 }
 
                 // Store token
-                localStorage.setItem('authToken', data.token);
+                localStorage.removeItem('authToken');
 
                 // Redirect to main app (replace history to prevent back button issues)
                 window.location.replace('/');