v0.332.0 (live rc.2 + security review): the pass redirect is absolute; no pass for a cross-site request; no dot-segments in to (R-1100)

CHANGELOG.md

@@ -36,6 +36,15 @@ brief of 2026-10-19 (felhom.eu `REPORT-day-2026-10-19.md`); design: felhom.eu `a
   `TestFileBrowserConfig_R1100_TrustsOnlyTheBoxSecret`, `_HeaderUserGetsTheHouseholdsRights`,
   `TestFileBrowserRoute_R1100_AsksTheControllerAndStripsTheHeader` (each red-proved). Link tests now read the folder from
   the pass link's `to`. i18n fixtures: none changed (no fixture page shows a folder link or the note).
+  **Hardening after the live rc.2 walk and a security review (same release):** the pass answer's redirect to the folder
+  is ABSOLUTE (`https://files.<domain>/…`) — traefik makes a relative Location from a forwardAuth answer absolute against
+  the controller's own address (rc.2 on 9201 sent the browser to `http://felhom-controller:8080/files/`); `/__files/open`
+  mints no pass for a request another site started (`Sec-Fetch-Site: cross-site` → the launcher, a login-CSRF into the
+  household's own files at a path the other site picked); `to` refuses dot-segments (`..`, `.`, also percent-encoded),
+  so it cannot resolve out of `/files/`. Tests `TestFilesSSO_R1100_CrossSiteNoPass` and the absolute-Location check,
+  red-proved („a cross-site request got a pass"; `safeFilesPath("/files/../api/x")`; `302 → "/files/HDD%202/media"`).
+  **Residual, stated:** FileBrowser's own token for the header user (2 h, its `tokenExpirationHours`) is cleared with
+  the files cookie, but a browser that lost only the files cookie keeps that token until it expires.
 
 - **The wizard's typed-back words now go to the box, not only to the browser.** The claim asks the agent to keep the
   new package (`{"defer_upload": true}`); an agent ≥ 0.160.0 answers with `confirm_required` and the two word