v0.333.0 (unreleased): the R-1155 check reads every token source FileBrowser reads, Basic auth included (security review)

CHANGELOG.md

@@ -7,13 +7,16 @@ claim answer the agent already gives). No golden (`09` §3 decision 250). Task:
   one-sign-in user's FileBrowser token (HS256 JWT; claims `belongsTo`, `Permissions{admin,…}`, `iat`, `exp` 2 h, `iss`
   — no user name) still opened `/api/users?id=self` (200) after the dashboard sign-out, as a cookie and as a Bearer
   header. The forwardAuth answer (`ServeFilesAuth`) now refuses a request that has NO valid files cookie but carries a
-  NON-admin FileBrowser token — in the `filebrowser_quantum_jwt` cookie, an `Authorization: Bearer` header or the
-  `auth` query parameter — exactly like a stale files cookie: both cookies cleared, a browser sent to the dashboard
+  NON-admin FileBrowser token — anywhere FileBrowser 1.5.6 reads one (`backend/http/auth.go` `extractToken`): the
+  `filebrowser_quantum_jwt` cookie, the `auth` query parameter, `Authorization: Bearer` (split on a space, as FileBrowser
+  does) and `Authorization: Basic` with the token as the PASSWORD (the commit's security review found Basic missing
+  from the first version, c809dd3; never released) — exactly like a stale files cookie: both cookies cleared, a browser sent to the dashboard
   (`/__files/open`, which re-issues the pass while the session lives), anything else 401. `admin`'s token (the password
   fallback) and FileBrowser's sign-in page still pass; an unreadable token passes on to FileBrowser, which refuses it.
   The signature is not checked here and need not be: this check can only refuse. `carriesNonAdminFileBrowserToken`;
   `TestFilesSSO_R1155_HouseholdTokenDiesWithTheSignOut` — red-proved both ways: without the check the household's
-  token alone passes after the sign-out (200); with every token refused, admin's own token gets 302.
+  token alone passes after the sign-out (200); without the Basic branch the token as a Basic password passes (200); with
+  every token refused, admin's own token gets 302.
 - **The recovery-code page tells the truth about when the code is live (R-1161).** Since R-1151 (agent ≥ 0.160.0) the
   new code becomes live only when the two words come back; the page still said „Ez mostantól az élő helyreállítási
   kód". It now shows „Ez a kód az ellenőrzés után lesz az élő helyreállítási kód: írd be lent a két kért szót. Addig a