view: harden token storage, framing and VS Code messages before announcing the view #2074

Found in the review of #2057, which adds the experimental view. It does not block that PR; #2059 fixed the findings that did. Paths refer to #2059's head.

Summary

Hardening to do before the view at graphcal.org/view is announced. No exploit was found; the review found no HTML injection sink, and the token is sent only in the Authorization header to https://api.github.com.

• Token storage. web/view/src/login.ts keeps the GitHub token in localStorage. /view/ shares its origin with the documentation and /playground/, which have no CSP, so script injected into any of them could read the token. "Forget token" does not reach other open tabs.
• Framing and forms. web/view/vite.config.ts puts frame-ancestors 'none' in a meta CSP, where browsers ignore it, so the page can be framed. There is no form-action. Add form-action 'none', and refuse to use the token when the page runs inside a frame.
• VS Code messages. web/view/src/vscodeHost.ts trusts messages from the extension without a zod schema and without checking their source.
• Token format. The sign-in dialog does not check the token's format.
• Cache comment. The comment at the top of web/view/src/github.ts overstates the cache: conditional requests answered with 304 still count against the anonymous rate limit.

Open question

How should the token be protected?

• Recommended: serve the view from its own origin (for example view.graphcal.org).
• Without a new origin: keep the token in sessionStorage by default, make remembering it opt-in, and follow storage events.