security(frontend): Keep API keys out of persisted localStorage

## Summary The authentication Zustand store persists its entire state, including the OpenAlgo API key, to browser localStorage. ## Evidence - `frontend/src/stores/authStore.ts:14` includes `apiKey` in store state. - `frontend/src/stores/authStore.ts:25-33` wraps the store with `persist` and updates the key. - The persistence configuration near `:90` does not exclude sensitive fields. ## Why this matters Any script executing in the origin can read localStorage, and values survive tab/browser restarts. Avoiding persistence reduces exposure duration if a frontend dependency or injected script is compromised. ## Scope Use Zustand `partialize` or split transient credential state so only non-sensitive state is persisted. Add a migration/cleanup path for previously stored `apiKey` values and tests for hydration. ## Acceptance criteria - [ ] New writes to localStorage never contain an API key. - [ ] A legacy persisted key is removed or ignored during hydration. - [ ] The key remains usable in memory during the active application session. - [ ] Logout still clears in-memory credential state. - [ ] Tests use fake storage and obvious dummy values. ## Verification ```powershell npm run test:run -- src/stores/authStore.test.ts npm run lint ``` ## Security guidance Do not post or use real API keys, access tokens, OTPs, passwords, or broker credentials. Use obvious test values such as `test-token-not-real` and keep regression tests fully local. ## First-time contributor notes - Difficulty: Medium - Estimated time: 2-4 hours - Broker credentials required: No - You will learn: browser storage risk, Zustand persistence, and state migration tests. - Please comment on this issue before starting so contributors can avoid duplicate work.