refactor: remove all cross-origin browser-direct federation code

- Delete storeFederationToken function from app.js
- Delete window.addEventListener('message',...) handler from app.js
- Delete buildAuthTileHTML function from app.js
- Delete formatLastSeen function from app.js
- Delete buildOfflineTileHTML function from app.js
- Delete openLoginPopup function from app.js
- Simplify api() to same-origin only (no baseUrl/credentials/X-Muxplex-Token)
- Remove federation auth relay <script> block from index.html
- Remove /api/auth/token endpoint from main.py
- Remove CORSMiddleware from main.py
- Remove X-Muxplex-Token header check from auth.py
- Delete corresponding tests and add absence verification tests

muxplex/main.py

@@ -32,7 +32,6 @@ from fastapi.responses import HTMLResponse
 from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel, field_validator
 from starlette.responses import JSONResponse, RedirectResponse
-from starlette.middleware.cors import CORSMiddleware
 
 from muxplex.auth import (
     AuthMiddleware,
@@ -267,20 +266,6 @@ app.add_middleware(
     federation_key=_federation_key,
 )
 
-# CORS: allow_origins=["*"] with allow_credentials=True is intentional for
-# self-hosted federation. Starlette reflects the actual Origin header (rather
-# than "*") when credentials are requested, so credentialed cross-origin
-# requests work correctly. Do not restrict to a fixed origin list without
-# first understanding how remote muxplex peers discover and reach each other.
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=True,
-    allow_methods=["*"],
-    allow_headers=["*"],
-)
-
-
 # ---------------------------------------------------------------------------
 # Request / response models
 # ---------------------------------------------------------------------------
@@ -858,19 +843,6 @@ async def logout() -> RedirectResponse:
     return response
 
 
-@app.get("/api/auth/token")
-async def get_auth_token(request: Request):
-    """Return the current session token for federation relay.
-
-    Only accessible when already authenticated (via cookie or localhost bypass).
-    Used by the login popup to relay the token back to the opener window via postMessage.
-    """
-    cookie = request.cookies.get("muxplex_session")
-    if cookie and verify_session_cookie(_auth_secret, cookie, _auth_ttl):
-        return {"token": cookie}
-    return JSONResponse({"error": "not authenticated"}, status_code=401)
-
-
 @app.get("/auth/mode")
 async def auth_mode_endpoint():
     """Return the current auth mode and running username."""