fix(auth): implement DB-first auth, persistent bearer token, secure cookies, and CLI reset_password script

app/static/js/app.js

@@ -1,5 +1,27 @@
 // Notes Application Frontend Logic - Complete SRS, Heatmap, Quiz, and Analytics
-document.addEventListener('DOMContentLoaded', () => {
+    // Persistent session: auto-inject Authorization header if token exists in localStorage
+    const originalFetch = window.fetch;
+    window.fetch = function(url, options = {}) {
+        const token = localStorage.getItem('notes_token');
+        if (token && typeof url === 'string' && url.startsWith('/api/')) {
+            options.headers = options.headers || {};
+            if (options.headers instanceof Headers) {
+                if (!options.headers.has('Authorization')) {
+                    options.headers.set('Authorization', `Bearer ${token}`);
+                }
+            } else if (Array.isArray(options.headers)) {
+                if (!options.headers.some(([k]) => k.toLowerCase() === 'authorization')) {
+                    options.headers.push(['Authorization', `Bearer ${token}`]);
+                }
+            } else {
+                if (!options.headers['Authorization']) {
+                    options.headers['Authorization'] = `Bearer ${token}`;
+                }
+            }
+        }
+        return originalFetch.call(this, url, options);
+    };
+
     // Register PWA Service Worker
     if ('serviceWorker' in navigator) {
         navigator.serviceWorker.register('/sw.js', { scope: '/' })
@@ -7,6 +29,7 @@ document.addEventListener('DOMContentLoaded', () => {
             .catch(err => console.log('Notes ServiceWorker failed:', err));
     }
 
+
     // App State
     let currentUser = null;
     let currentLookupData = null;
@@ -385,6 +408,9 @@ document.addEventListener('DOMContentLoaded', () => {
             });
             const data = await resp.json();
             if (resp.ok && data.status === 'ok') {
+                if (data.token) {
+                    localStorage.setItem('notes_token', data.token);
+                }
                 currentUser = data.user;
                 showApp();
                 loadInitialData();
@@ -399,11 +425,13 @@ document.addEventListener('DOMContentLoaded', () => {
     });
 
     logoutBtn.addEventListener('click', async () => {
+        localStorage.removeItem('notes_token');
         await fetch('/api/logout', { method: 'POST' });
         currentUser = null;
         window.location.reload();
     });
 
+
     // -----------------------------------------------------------------------
     // Data Loading: Cards, Collections, Tags, Stats
     // -----------------------------------------------------------------------