pastilhasandClaude Opus 4.8
aae0fbd0ea
- token-store: shared "give me a valid Vaultwarden access token" (proactive refresh) used by both the HTTP proxy and the WS; router refactored onto it. - notifications WS: validates the platform session in `open` (deferred, owner only), injects the stored Vaultwarden token into the upstream, and buffers client frames during the async setup so the SignalR handshake isn't dropped. The device connects with its platform JWT (?access_token=), never a vault one. - lifecycle: logout drops the vault token set (keeps the protector); distress (/auth/revoke) and panic wipe both token set and protector, forcing a one-time master-password re-setup. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>