web: Referrer-Policy same-origin; a password shown once emptied on pagehide

D-B3. Fetch Standard § 3.2 "append a request `Origin` header": under
Referrer-Policy no-referrer a request that is not GET/HEAD and not CORS -
a form POST, a navigation - gets Origin "null". originAllowed() refuses
"null" whenever Sec-Fetch-Site is absent, and Fetch Metadata § 3 sends
Sec-Fetch-Site only to a potentially trustworthy URL: every form,
sign-in included, failed in Safari before 16.4 and in any browser on a
plain-HTTP panel at a name. same-origin nulls Origin only for a request
not same origin with its URL and still sends no referrer to another
site. The comments of the origin check say so.

D-B13. noStore keeps the page out of HTTP caches (RFC 9111 § 5.2.2.5);
a history mechanism "might honor" it (§ 6), and Pragma in a response
"was never specified" (§ 5.4) - it goes. CopyField.Secret marks the
password of out-app-created data-secret, and panel.js empties such
fields on pagehide (HTML § 7.5.9, "unload a Document", step 10.2: fired
whether or not the document is kept for history traversal).

Measured 2026-10-15 in Chrome 152 (the desktop app's browser), a local
probe page with Cache-Control: no-store and a data-secret field: Back
reloads it (pageshow persisted=false, a new load), so this browser keeps
no-store pages out of its back/forward cache; the handler, fired on the
same page, empties the field. Firefox and Safari not measured.

Tests: the header value; the created page has the password data-secret
and the login not, no Pragma. Stand (2026-10-15, make e2e, exit 0): new
form_post_with_the_browsers_origin - Referrer-Policy: same-origin on a
page; a POST carrying the page's own Origin and no Sec-Fetch-Site, what
a browser sends now, passes; one carrying Origin: null, what it sent
before, is 403. (A first run failed where the e2e client and a view test
scraped the old input markup; both read data-secret now.) go vet and go
test ./... pass on the server (24 packages).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/audit-2026-10-12.md

@@ -989,12 +989,16 @@ those after it move up one patch number each.
    connection is silent in all three milters (libmilter read: sendmail
    8.17.1.9 fetched into dev/upstream); the expiry notice waits for a renewal
    that is on time.
-- [ ] **The panel in browsers without Sec-Fetch-Site** (D-B3, D-B13): under
+- [x] **The panel in browsers without Sec-Fetch-Site** (D-B3, D-B13): under
    `Referrer-Policy: no-referrer` a form POST carries `Origin: null`, which
    the origin check refuses - every POST, sign-in included, fails in Safari
    before 16.4 and over plain HTTP at a name; `same-origin` instead, with a
    header test and one POST on the stand. A shown-once secret is blanked on
    `pagehide`; `Pragma` goes. - **Opus**
+   *Done 2026-10-15.* Measured the same day in Chrome 152 (the desktop
+   app's browser): a `no-store` page is not restored from the back/forward
+   cache (pageshow persisted=false, a fresh load); the `pagehide` handler is
+   for browsers that do restore one. Firefox and Safari not measured.
 - [ ] **Two processes opening an old database** (D-S3): `user_version` is
    read outside the transaction, so the panel and dmarc-ingest can both
    run one migration; `_txlock=immediate` and the version re-read inside