Problem

The self-hosted dashboard passes its auth token as a URL query parameter (?token=). This leaks the token to browser history, server access logs, referrer headers, and proxy/CDN logs.

Fix

Replace query-param auth with a cookie-based session:

1. POST the token to a /login endpoint
2. Server sets a HttpOnly; Secure; SameSite=Strict session cookie
3. All dashboard routes check the cookie, not the query param

Affected files

• internal/serve/serve.go