fix: harden SAC security per audit (0.4.15)

Close audit findings: anti-spoof client IP for login rate limit, JWT/CORS
enforce on startup, SSH host-key verification and sudo via stdin, optional
WinRM HTTPS, SSE httpOnly cookie auth, ingest body limit, ILIKE escaping,
and HMAC API key hashing with legacy SHA-256 fallback.

frontend/src/api.ts

@@ -1,4 +1,4 @@
-const TOKEN_KEY = "sac_token";
+const TOKEN_KEY = "sac_token";
 const ROLE_KEY = "sac_role";
 
 export function getToken(): string | null {
@@ -31,6 +31,14 @@ export function clearToken(): void {
   localStorage.removeItem(ROLE_KEY);
 }
 
+export async function logoutApi(): Promise<void> {
+  try {
+    await fetch("/api/v1/auth/logout", { method: "POST", credentials: "same-origin" });
+  } catch {
+    /* ignore network errors on logout */
+  }
+}
+
 export class ApiError extends Error {
   status: number;
 
@@ -55,7 +63,7 @@ export async function apiFetch<T>(path: string, init: RequestInit = {}): Promise
   if (token) {
     headers.set("Authorization", `Bearer ${token}`);
   }
-  const res = await fetch(path, { ...init, headers });
+  const res = await fetch(path, { ...init, headers, credentials: "same-origin" });
   const text = await res.text();
   if (res.status === 401) {
     if (hadToken) {