The v1 security gate. Three fixes:
- URLSession.shared's persistent URLCache could write authenticated response bodies (private repo content) to an unprotected Cache.db, and its cookie jar persists — the client now defaults to an ephemeral session with cookies refused; the in-memory per-account ETag store is the only cache
- Usage-error logs carried server messages at .public; they can echo pasted content (keys, codes) and are now .private alongside argv
- privacySensitive on the token field
Audited clean and pinned by SecurityTests: Keychain accessibility (WhenUnlockedThisDeviceOnly, one save path, never synchronizable), token travels exactly once per request into the Authorization header after the isOwn pre-flight, redirect/downgrade/port-swap/host-suffix refusals, plaintext refused off loopback with default ATS as the OS-level backstop, UserDefaults carries only the account id, cache keys are one-way token digests, no pasteboard writes, no entitlements, Highlightr pinned 2.3.0 (JSC runs highlight.js over file content — no bridge beyond Highlightr's API, accepted).
138 unit tests green; read-only live smoke green on the ephemeral transport.
Closes #2 Ref #11