security: fix C2, H5 and M1

C2 - JWT token was stored in localStorage (XSS-accessible):
  - Switch Zustand persist storage from localStorage to sessionStorage
  - Token is now scoped to the current tab and cleared on browser close

H5 - docker-compose had unsafe SECRET_KEY fallback:
  - Replace ${SECRET_KEY:-change_me_in_production} with :? syntax
  - Docker Compose now aborts with a clear error if SECRET_KEY is unset

M1 - Login endpoint had timing leak allowing username enumeration:
  - Always call verify_password() regardless of username match
  - Use hmac.compare_digest() for constant-time username comparison
  - Both checks run every time; attacker cannot distinguish wrong
    username from wrong password via response timing

frontend/src/stores/authStore.ts

@@ -1,5 +1,5 @@
 import { create } from 'zustand'
-import { persist } from 'zustand/middleware'
+import { persist, createJSONStorage } from 'zustand/middleware'
 
 interface AuthState {
   token: string | null
@@ -16,6 +16,11 @@ export const useAuthStore = create<AuthState>()(
       login: (token) => set({ token, isAuthenticated: true }),
       logout: () => set({ token: null, isAuthenticated: false }),
     }),
-    { name: 'homelable-auth' }
+    {
+      name: 'homelable-auth',
+      // sessionStorage: scoped to the tab, cleared on browser close.
+      // Prevents XSS from other tabs stealing the token via localStorage.
+      storage: createJSONStorage(() => sessionStorage),
+    }
   )
 )