fix(controlplane): keep download login tokens out of URLs
Browser artifact login currently puts a user session token in the control-plane download URL. Replace it with a PKCE-bound, single-use handoff exchanged on the server, and enforce a ten-second user-token lifetime even when login requests long-lived credentials. 2
Each in-flight download has its own verifier cookie, so overlapping handoffs do not overwrite or clear one another. Cookies remain Secure in production and preserve the existing AuthService exception for local HTTP development.
Reject legacy user-token ?t= download callbacks. Existing frontend downloads, CLI artifact downloads, and the separate 30-second CAS download token retain their current behavior. Browser logins already in flight during the upgrade must restart.
This implements the follow-up to D-008 in the login code exchange spec, replacing its legacy-download exception while reusing the existing handoff mechanism (R-001/R-002).
Closes https://linear.app/chainloop/issue/PFM-7829
AI assistance: Codex.