v1.0.0: security sweep #2

Gap to close before the App Store submission — a full pass over the trust surface:

• Keychain items: verify accessibility classes, ThisDeviceOnly on every entry, nothing token-shaped in UserDefaults, logs, or crash reports
• Token never leaves the instance origin: re-audit redirect guard, isOwn checks, and any URL built outside GitbayInstance
• ATS configuration; confirm the http-for-loopback exception cannot apply to a non-loopback host
• Pasteboard hygiene on the token field; background app snapshot does not show the token screen
• Dependency review (Highlightr is the only third-party code) and pinned versions
• os.Logger privacy annotations: argv stays private, server messages public only where intended

Blocks v1.0.0.

Sweep complete in !11. Findings: (1) URLSession.shared's disk cache could store authenticated response bodies — replaced with an ephemeral session, cookies refused; (2) usage-error logs echoed server messages at .public — now .private; (3) token field marked privacySensitive. Everything else audited clean and pinned by SecurityTests: Keychain classes, single Authorization interpolation behind isOwn, redirect/downgrade/port/host-suffix refusals, loopback-only plaintext with ATS default as backstop, UserDefaults holds only the account id, one-way cache keys, no pasteboard writes, no entitlements, Highlightr pinned.

Closing: the sweep landed in 03b7b65. This stayed open only because the closing keyword was in the merge request body rather than the commit message, and commitrefs scans commits.