security: fix C2, H5 and M1

C2 - JWT token was stored in localStorage (XSS-accessible):
  - Switch Zustand persist storage from localStorage to sessionStorage
  - Token is now scoped to the current tab and cleared on browser close

H5 - docker-compose had unsafe SECRET_KEY fallback:
  - Replace ${SECRET_KEY:-change_me_in_production} with :? syntax
  - Docker Compose now aborts with a clear error if SECRET_KEY is unset

M1 - Login endpoint had timing leak allowing username enumeration:
  - Always call verify_password() regardless of username match
  - Use hmac.compare_digest() for constant-time username comparison
  - Both checks run every time; attacker cannot distinguish wrong
    username from wrong password via response timing

backend/app/api/routes/auth.py

@@ -1,3 +1,5 @@
+import hmac
+
 import yaml
 from fastapi import APIRouter, HTTPException, status
 from pydantic import BaseModel
@@ -28,7 +30,11 @@ def _load_credentials() -> tuple[str, str]:
 @router.post("/login", response_model=TokenResponse)
 async def login(body: LoginRequest) -> TokenResponse:
     username, password_hash = _load_credentials()
-    if body.username != username or not verify_password(body.password, password_hash):
+    # Always run both checks to prevent timing-based username enumeration.
+    # hmac.compare_digest is constant-time; verify_password (bcrypt) always runs.
+    username_ok = hmac.compare_digest(body.username, username)
+    password_ok = verify_password(body.password, password_hash)
+    if not username_ok or not password_ok:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid credentials")
     token = create_access_token(body.username)
     return TokenResponse(access_token=token)

docker-compose.yml

@@ -5,7 +5,7 @@ services:
       dockerfile: Dockerfile.backend
     restart: unless-stopped
     environment:
-      SECRET_KEY: ${SECRET_KEY:-change_me_in_production}
+      SECRET_KEY: ${SECRET_KEY:?SECRET_KEY must be set in the environment or a .env file}
       SQLITE_PATH: /app/data/homelab.db
       CONFIG_PATH: /app/config.yml
       CORS_ORIGINS: '["http://localhost:3000"]'

frontend/src/stores/authStore.ts

@@ -1,5 +1,5 @@
 import { create } from 'zustand'
-import { persist } from 'zustand/middleware'
+import { persist, createJSONStorage } from 'zustand/middleware'
 
 interface AuthState {
   token: string | null
@@ -16,6 +16,11 @@ export const useAuthStore = create<AuthState>()(
       login: (token) => set({ token, isAuthenticated: true }),
       logout: () => set({ token: null, isAuthenticated: false }),
     }),
-    { name: 'homelable-auth' }
+    {
+      name: 'homelable-auth',
+      // sessionStorage: scoped to the tab, cleared on browser close.
+      // Prevents XSS from other tabs stealing the token via localStorage.
+      storage: createJSONStorage(() => sessionStorage),
+    }
   )
 )