fix(cms): Safari-compatible authentication

Safari-specific deviations fixed:

1. Safari shows its native auth dialog on fetch() calls answered with a
   401 + WWW-Authenticate challenge (e.g. save with an expired session).
   All CMS 401 responses now omit WWW-Authenticate; browsers use the styled
   /login page instead.
2. Safari caches Basic credentials and resends them automatically, which
   made logout ineffective (a navigation after logout went straight back
   into the editor). Browser navigations (GET + text/html) now authenticate
   ONLY via the session cookie; Basic Auth remains valid for non-browser
   clients (curl, API).
3. /login and redirects send Cache-Control: no-store so Safari does not
   cache the login page or the 302.

Closes MITHOME-62

scripts/test-content-editor-logout.js

@@ -47,10 +47,11 @@ async function waitForServer(timeoutMs = 10000) {
 async function main() {
   await waitForServer();
 
-  // 1. /logout answers 401 with a challenge header, without credentials
+  // 1. /logout answers 401 without a Basic challenge (Safari would pop its
+  //    native auth dialog on challenged fetch calls)
   const logoutRes = await fetch(`${BASE}/logout`);
   assert.equal(logoutRes.status, 401);
-  assert.match(logoutRes.headers.get('www-authenticate') || '', /Basic realm="mozdIT CMS"/);
+  assert.equal(logoutRes.headers.get('www-authenticate'), null);
 
   // 2. /logout is exempt from the auth rate limiter: many logout calls must not
   //    consume the failed-login budget.