fix: address multiple code audit findings

- CORS: replace wildcard with explicit origin list from CORS_ORIGINS env
- Auth: enforce strong defaults, JWT blacklist (RevokedToken model), login rate limiting
- Auth: validate password length before bcrypt (72-byte limit)
- Scheduler: single-threaded worker to mitigate SQLite write contention
- Scheduler: graceful shutdown (wait=True)
- Snapshots: add prune_snapshots() with configurable retention count
- Storage: isolate localStorage keys via VITE_APP_KEY prefix
- Config: add cors_origins, login_rate_limit, snapshot_retention_count settings

frontend/src/api/index.ts

@@ -1,5 +1,6 @@
 import axios from 'axios'
 import router from '@/router'
+import { authStorageKeys } from '@/authStorage'
 
 export const api = axios.create({
   baseURL: '/',
@@ -10,8 +11,8 @@ api.interceptors.response.use(
   (r) => r,
   (err) => {
     if (err.response?.status === 401) {
-      localStorage.removeItem('smartup_token')
-      localStorage.removeItem('smartup_email')
+      localStorage.removeItem(authStorageKeys.token)
+      localStorage.removeItem(authStorageKeys.email)
       router.push('/login')
     }
     return Promise.reject(err)
@@ -293,6 +294,7 @@ export const browserSessionsApi = {
   get: (id: string) => api.get<BrowserSessionData>(`/api/browser-sessions/${id}`),
   event: (id: string, data: BrowserEventPayload) =>
     api.post<BrowserSessionData>(`/api/browser-sessions/${id}/events`, data),
+  selection: (id: string) => api.get<{ text: string }>(`/api/browser-sessions/${id}/selection`),
   close: (id: string) => api.delete(`/api/browser-sessions/${id}`),
   screenshotUrl: (id: string, token?: string) => {
     const params = new URLSearchParams({ t: String(Date.now()) })