Dashboard token accepted as ?token= query parameter (leaks into logs, history, referrers)

[jaylfc]

server.py:324-327 accepts the master DASHBOARD_TOKEN as a ?token= query parameter on any dashboard route. Query strings end up in proxy/access logs, browser history, and Referer headers. The exposure is limited — it exists for the menu-bar bootstrap and immediately swaps to an opaque session cookie (server.py:1223-1229) — but it's still the master credential in a URL.

Fix: restrict the bootstrap to a dedicated endpoint that accepts a short-lived single-use bootstrap token minted by the server-side menubar (which can read .env locally), instead of the master token; or at minimum restrict ?token= to the / route and document the trade-off.

Full context: AUDIT.md (S4).