refactor: move auth token to HttpOnly cookie, fix CORS and artefacts

Backend:
- Set JWT as HttpOnly cookie on login, add cookie fallback in auth middleware
- Add /auth/logout endpoint to clear cookie
- Fix CORS to echo origin with Allow-Credentials for withCredentials requests
- Make SPA static serving optional via SERVE_SPA config flag

Frontend:
- Remove manual token management; rely on HttpOnly cookie + withCredentials
- Simplify auth-slice to authenticated boolean flag
- Fix Artefact interface to match backend fields (sha256Hash, fileName, fileSize)
- Fix artefact upload endpoint and send version in FormData
- Use KiB/MiB for file size display
- Move Redux hooks from store/hooks to hooks/store

internal/config/config.go

@@ -17,6 +17,7 @@ type Config struct {
 	MaxConcurrent int
 	BandwidthBPS  int
 	RateLimitRPS  int
+	ServeSPA      bool
 }
 
 func Load() *Config {
@@ -34,6 +35,7 @@ func Load() *Config {
 		MaxConcurrent: envOrDefaultInt("MAX_CONCURRENT_DOWNLOADS", 50),
 		BandwidthBPS:  envOrDefaultInt("BANDWIDTH_BPS", 10*1024*1024/50),
 		RateLimitRPS:  envOrDefaultInt("RATE_LIMIT_RPS", 100),
+		ServeSPA:      envOrDefaultBool("SERVE_SPA", true),
 	}
 }
 
@@ -52,3 +54,12 @@ func envOrDefaultInt(key string, def int) int {
 	}
 	return def
 }
+
+func envOrDefaultBool(key string, def bool) bool {
+	if v := os.Getenv(key); v != "" {
+		if b, err := strconv.ParseBool(v); err == nil {
+			return b
+		}
+	}
+	return def
+}