fix(auth): stop leaking the token via URL, log and Referer

A token passed as `?token=` was accepted on every route, so it ended
up in the request log (and journald), browser history and Referer.

- drop `?token=` from _check_auth; API and download routes now take
  only the cookie or an Authorization: Bearer header
- keep pre-authenticated links working: on the index route a valid
  `?token=` is swapped for the cookie and redirected to a clean URL,
  so the secret does not linger in the address bar
- redact `token=` from log output
- send Referrer-Policy: no-referrer, and mark the cookie Secure

SETUP.md

@@ -91,6 +91,12 @@ browser will show a certificate warning; that is expected for a self-signed cert
 accept it once. Enter the token on the login page; it is stored in an `HttpOnly`
 cookie for a year.
 
+You can also hand out a pre-authenticated link, `https://<host>:3001/?token=YOUR_TOKEN`.
+Opening it swaps the token for the cookie and immediately redirects to `/`, so the
+token does not stay in the address bar, history or Referer. `?token=` works **only**
+on that entry page — API and download routes require the cookie or an
+`Authorization: Bearer` header, and the token is redacted from the server log.
+
 ## Networking notes
 
 - The server binds `0.0.0.0`, so it is reachable from the whole LAN.