security: fix C2, H5 and M1

C2 - JWT token was stored in localStorage (XSS-accessible):
  - Switch Zustand persist storage from localStorage to sessionStorage
  - Token is now scoped to the current tab and cleared on browser close

H5 - docker-compose had unsafe SECRET_KEY fallback:
  - Replace ${SECRET_KEY:-change_me_in_production} with :? syntax
  - Docker Compose now aborts with a clear error if SECRET_KEY is unset

M1 - Login endpoint had timing leak allowing username enumeration:
  - Always call verify_password() regardless of username match
  - Use hmac.compare_digest() for constant-time username comparison
  - Both checks run every time; attacker cannot distinguish wrong
    username from wrong password via response timing

docker-compose.yml

@@ -5,7 +5,7 @@ services:
       dockerfile: Dockerfile.backend
     restart: unless-stopped
     environment:
-      SECRET_KEY: ${SECRET_KEY:-change_me_in_production}
+      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY must be set in the environment or a .env file}
       SQLITE_PATH: /app/data/homelab.db
       CONFIG_PATH: /app/config.yml
       CORS_ORIGINS: '["http://localhost:3000"]'