fix(auth): SECRET_KEY di default rifiutato, session.permanent, logout solo POST (#33)

config.py: guard_default_secret_key, verificata a ogni richiesta (prima di
create_app, TESTING/DEBUG non sono ancora impostati dai fixture di test) —
rifiuta con RuntimeError se CLIENT_SECRET_KEY è rimasto al default committato
fuori da debug/testing. auth.py: session.permanent=True al login (senza,
PERMANENT_SESSION_LIFETIME non aveva mai effetto); /auth/logout solo POST,
con CSRF. Aggiornati i tre punti che lo chiamavano: profile.html e
navbar.html (link -> form POST), auto-logout JS in base.html (fetch POST +
redirect al login).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/config.py

@@ -4,12 +4,17 @@ from dotenv import load_dotenv
 
 load_dotenv(os.path.join(os.path.dirname(__file__), '..', '.env'))
 
+# Committed default for CLIENT_SECRET_KEY (also in .env.example). A Flask
+# session is only as secret as this value: left at the default, anyone can
+# forge a session cookie (roles, is_admin) - see guard_default_secret_key (#33).
+DEFAULT_SECRET_KEY = "change-this-to-another-random-secret-key"
+
 
 class Config:
     """Flask client configuration."""
 
     # Flask
-    SECRET_KEY = os.getenv("CLIENT_SECRET_KEY", "change-this-to-another-random-secret-key")
+    SECRET_KEY = os.getenv("CLIENT_SECRET_KEY", DEFAULT_SECRET_KEY)
     DEBUG = os.getenv("FLASK_DEBUG", "0") == "1"
 
     # API Server connection
@@ -41,3 +46,22 @@ class Config:
     BABEL_DEFAULT_LOCALE = "it"
     BABEL_DEFAULT_TIMEZONE = "Europe/Rome"
     LANGUAGES = {"it": "Italiano", "en": "English"}
+
+
+def guard_default_secret_key(app) -> None:
+    """Refuse to serve when CLIENT_SECRET_KEY was left at its committed default (#33).
+
+    Checked per-request (wired as a ``before_request`` in app.py) rather than
+    at import/create_app time: pytest and every fixture in this suite call
+    ``create_app()`` and only *afterwards* set ``app.config["TESTING"]``, so a
+    check made during app creation would always see TESTING as False and
+    break the whole test suite and local `flask run` alike.
+    """
+    if app.debug or app.testing:
+        return
+    if app.config.get("SECRET_KEY") == DEFAULT_SECRET_KEY:
+        raise RuntimeError(
+            "CLIENT_SECRET_KEY non impostato: la sessione Flask (ruoli, is_admin) "
+            "sarebbe falsificabile da chiunque conosca il default committato. "
+            "Imposta CLIENT_SECRET_KEY in .env prima di avviare in produzione."
+        )