MVP token storage uses in-memory + localStorage for now. Upgrade to httpOnly cookie session in a subsequent hardening pass.