fix(cms): Safari-compatible authentication

Safari-specific deviations fixed:

1. Safari shows its native auth dialog on fetch() calls answered with a
   401 + WWW-Authenticate challenge (e.g. save with an expired session).
   All CMS 401 responses now omit WWW-Authenticate; browsers use the styled
   /login page instead.
2. Safari caches Basic credentials and resends them automatically, which
   made logout ineffective (a navigation after logout went straight back
   into the editor). Browser navigations (GET + text/html) now authenticate
   ONLY via the session cookie; Basic Auth remains valid for non-browser
   clients (curl, API).
3. /login and redirects send Cache-Control: no-store so Safari does not
   cache the login page or the 302.

Closes MITHOME-62

scripts/test-content-editor-login.js

@@ -116,10 +116,26 @@ async function main() {
     assert.equal(redirected.status, 302);
     assert.equal(redirected.headers.get('location'), '/login');
 
-    // 6. non-browser requests keep the 401 challenge (curl/API compatibility)
+    // 6. non-browser requests get a plain 401 WITHOUT a Basic challenge
+    //    (Safari pops its native auth dialog on challenged fetch calls).
     const apiStyle = await fetch(`${BASE}/`);
     assert.equal(apiStyle.status, 401);
-    assert.match(apiStyle.headers.get('www-authenticate') || '', /Basic realm="mozdIT CMS"/);
+    assert.equal(apiStyle.headers.get('www-authenticate'), null);
+
+    // 7. Safari scenario: browser navigation with CACHED Basic credentials but no
+    //    session must still land on /login — otherwise logout would be ineffective
+    //    in browsers that resend Basic auth automatically.
+    const basic = 'Basic ' + Buffer.from('login-test-user:login-test-pass').toString('base64');
+    const safariLike = await fetch(`${BASE}/`, {
+      headers: { Authorization: basic, Accept: 'text/html,application/xhtml+xml' },
+      redirect: 'manual',
+    });
+    assert.equal(safariLike.status, 302);
+    assert.equal(safariLike.headers.get('location'), '/login');
+
+    // 8. the same credentials DO authenticate a non-browser request (curl/API)
+    const curlLike = await fetch(`${BASE}/`, { headers: { Authorization: basic } });
+    assert.equal(curlLike.status, 200);
 
     console.log('Content Editor login flow test: OK');
   } finally {

scripts/test-content-editor-logout.js

@@ -47,10 +47,11 @@ async function waitForServer(timeoutMs = 10000) {
 async function main() {
   await waitForServer();
 
-  // 1. /logout answers 401 with a challenge header, without credentials
+  // 1. /logout answers 401 without a Basic challenge (Safari would pop its
+  //    native auth dialog on challenged fetch calls)
   const logoutRes = await fetch(`${BASE}/logout`);
   assert.equal(logoutRes.status, 401);
-  assert.match(logoutRes.headers.get('www-authenticate') || '', /Basic realm="mozdIT CMS"/);
+  assert.equal(logoutRes.headers.get('www-authenticate'), null);
 
   // 2. /logout is exempt from the auth rate limiter: many logout calls must not
   //    consume the failed-login budget.