fix(security): plug credential leaks via redirects, foreign 401s, and the server-switch race

[SiteRelEnby]

Independent blast-radius assessment turned up three credential-exposure paths that the AuthInterceptor
origin-scoping (#37/#39) does not cover, because they live below the application-interceptor layer or in a
different component. All three verified against the current code.

1. TokenAuthenticator was origin-blind (the live one)

The shared authenticated client is handed to widgets via WidgetEntryPoint.okHttpClient(), and
WidgetAvatars.fetchSquareBitmap uses it to download avatar bytes from arbitrary hosts. AuthInterceptor
(from #37) wont *proactively* attach the bearer to an external host - but TokenAuthenticatoris a separate OkHttpAuthenticator`, and it was origin-blind. An external avatar host returning 401 made it refresh the
token and retry that request to the external host with the freshly minted bearer.

Fix: it now returns null for any 401 whose request isn`t the API origin - no refresh, no retry, no leak, and
no wasted refresh-token rotation.

2. Cross-origin redirects kept the CF-Access headers

AuthInterceptor is an application interceptor, so it only sees the original request. On an
API -> external redirect, OkHttp 4.12 strips Authorization but not custom headers, so CF-Access-* followed
to the external host.

Fix: CredentialGuardInterceptor, a network interceptor, which runs on every hop - redirect follow-ups
and authenticator retries included - and strips Authorization, CF-Access-Client-Id/Secret, and Cookie
from any request not going to the API origin. This is also a belt for (1).

3. Server-switch race (save-before-clear)

Both saveBaseUrl paths saved the new base URL before clearing the old session, leaving a window where the
new origin was configured but the old token was still present - so a concurrent request would be treated as
trusted and carry the old bearer to the new host. Now both (AuthViewModel, SettingsViewModel) clear tokens

• wipe before storing the new origin.

Why a network interceptor rather than re-pointing each caller

Widgets are only one consumer of the shared client. A per-hop network guard means any current or future use
that touches a foreign host - redirect, retry, or a new caller - cannot leak the session, without having to
find and re-point every call site. AuthInterceptor stays as the proactive scoping; this is the backstop.

Tests

• CredentialGuardInterceptorTest: strips all creds on a foreign/CDN hop, preserves them on the API origin,
  leaves non-credential headers alone.
• TokenAuthenticatorTest: a foreign-host (and CDN-host) 401 returns null without touching the refresh token.
• :app:assemblePlayRelease :app:testPlayReleaseUnitTest green, 166 tests.

No new user-facing behaviour - this hardens the "credentials only go to your server" promise already in the
changelog against three edge cases, so no changelog change.