fix(security): harden auth and secret handling (HH-444) (#101)

* fix(security): harden auth and credential handling (HH-444)

* fix(security): address HH-444 review blockers

* fix(security): close remaining HH-444 review blockers

---------

Co-authored-by: Rogee <rogee@ipao.vip>

frontend/app/javascript/dashboard/api/auth.spec.js

@@ -0,0 +1,17 @@
+import * as APIUtils from '../store/utils/api';
+import Auth from './auth';
+
+vi.spyOn(APIUtils, 'clearCookiesOnLogout').mockImplementation(() => {});
+vi.spyOn(APIUtils, 'deleteIndexedDBOnLogout').mockResolvedValue();
+
+describe('Auth.logout', () => {
+  it('clears browser credentials even when the server rejects logout', async () => {
+    globalThis.axios = {
+      delete: vi.fn().mockRejectedValue({ response: { status: 401 } }),
+    };
+
+    await expect(Auth.logout()).rejects.toEqual({ response: { status: 401 } });
+    expect(APIUtils.deleteIndexedDBOnLogout).toHaveBeenCalledOnce();
+    expect(APIUtils.clearCookiesOnLogout).toHaveBeenCalledOnce();
+  });
+});