fix(auth): SECRET_KEY di default rifiutato, session.permanent, logout solo POST (#33)

config.py: guard_default_secret_key, verificata a ogni richiesta (prima di
create_app, TESTING/DEBUG non sono ancora impostati dai fixture di test) —
rifiuta con RuntimeError se CLIENT_SECRET_KEY è rimasto al default committato
fuori da debug/testing. auth.py: session.permanent=True al login (senza,
PERMANENT_SESSION_LIFETIME non aveva mai effetto); /auth/logout solo POST,
con CSRF. Aggiornati i tre punti che lo chiamavano: profile.html e
navbar.html (link -> form POST), auto-logout JS in base.html (fetch POST +
redirect al login).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/templates/auth/profile.html

@@ -192,10 +192,13 @@
             {{ _('Termina la sessione corrente e torna alla schermata di login') }}
           </p>
           <div class="mt-3">
-            <a href="{{ url_for('auth.logout') }}"
-               class="inline-flex items-center px-4 py-2 border border-red-300 dark:border-red-700 rounded-lg shadow-sm text-sm font-medium text-red-700 dark:text-red-300 bg-white dark:bg-slate-800 hover:bg-red-50 dark:hover:bg-red-900/20 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-red-500 transition-all duration-200">
-              {{ _('Logout') }}
-            </a>
+            <form method="post" action="{{ url_for('auth.logout') }}" class="inline">
+              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+              <button type="submit"
+                      class="inline-flex items-center px-4 py-2 border border-red-300 dark:border-red-700 rounded-lg shadow-sm text-sm font-medium text-red-700 dark:text-red-300 bg-white dark:bg-slate-800 hover:bg-red-50 dark:hover:bg-red-900/20 focus:outline-none focus:ring-2 focus:ring-offset-2 focus:ring-red-500 transition-all duration-200">
+                {{ _('Logout') }}
+              </button>
+            </form>
           </div>
         </div>
       </div>

src/frontend/flask_app/templates/base.html

@@ -151,7 +151,17 @@
         var remaining = timeoutMs - elapsed;
         if (remaining <= 0) {
           clearInterval(this._interval);
-          window.location.href = '{{ url_for("auth.logout") }}';
+          // #33: /auth/logout is POST-only now (CSRF-protected), so a plain
+          // navigation would 405. Fire the logout, then leave regardless of
+          // the outcome - staying logged in client-side is worse than a
+          // logout call that failed silently.
+          var csrfMeta = document.querySelector('meta[name=csrf-token]');
+          fetch('{{ url_for("auth.logout") }}', {
+            method: 'POST',
+            headers: csrfMeta ? { 'X-CSRFToken': csrfMeta.content } : {}
+          }).finally(function() {
+            window.location.href = '{{ url_for("auth.login") }}';
+          });
         } else if (remaining <= warningMs) {
           this.showWarning = true;
           this.remainingSeconds = Math.ceil(remaining / 1000);

src/frontend/flask_app/templates/components/navbar.html

@@ -160,14 +160,17 @@
               {{ _('Logout') }}
             </span>
             {% else %}
-            <a href="{{ url_for('auth.logout') }}"
-               class="flex items-center gap-2.5 px-4 py-2.5 text-sm text-measure-fail
-                      hover:bg-red-50 dark:hover:bg-red-900/20 transition-colors">
-              <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="1.75" viewBox="0 0 24 24">
-                <path stroke-linecap="round" stroke-linejoin="round" d="M17 16l4-4m0 0l-4-4m4 4H7m6 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h4a3 3 0 013 3v1"/>
-              </svg>
-              {{ _('Logout') }}
-            </a>
+            <form method="post" action="{{ url_for('auth.logout') }}">
+              <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+              <button type="submit"
+                      class="w-full flex items-center gap-2.5 px-4 py-2.5 text-sm text-measure-fail
+                             hover:bg-red-50 dark:hover:bg-red-900/20 transition-colors">
+                <svg class="w-4 h-4" fill="none" stroke="currentColor" stroke-width="1.75" viewBox="0 0 24 24">
+                  <path stroke-linecap="round" stroke-linejoin="round" d="M17 16l4-4m0 0l-4-4m4 4H7m6 4v1a3 3 0 01-3 3H6a3 3 0 01-3-3V7a3 3 0 013-3h4a3 3 0 013 3v1"/>
+                </svg>
+                {{ _('Logout') }}
+              </button>
+            </form>
             {% endif %}
           </div>
         </div>