fix(#106): [SECURITY] scope recent files and favorites per user

Root cause: localStorage keys 'oxicloud_recent_files' and
'oxicloud_favorites' were global — shared across all users on the same
browser. When user A logged out and user B logged in, user B could see
(and access) user A's recent files and favorites.

Fixes applied:

recent.js:
- Storage key now user-specific: 'oxicloud_recent_files_{username}'
- getStorageKey() derives key from current user in localStorage
- migrateFromLegacyKey() moves data from old global key on init
- Legacy global key is always removed after migration

favorites.js:
- Same pattern: 'oxicloud_favorites_{username}'
- getStorageKey() + migrateFromLegacyKey() added

auth.js (logout):
- Clears user-specific recent and favorites keys before removing
  user data, plus removes any legacy global keys

Bumps service worker cache to v13.

static/js/auth.js

@@ -1211,6 +1211,20 @@ function redirectToMainApp() {
  * Logout - clear tokens and redirect to login
  */
 function logout() {
+    // Clear user-specific recent files and favorites before removing user data
+    try {
+        const userData = JSON.parse(localStorage.getItem(USER_DATA_KEY) || '{}');
+        if (userData.username) {
+            localStorage.removeItem(`oxicloud_recent_files_${userData.username}`);
+            localStorage.removeItem(`oxicloud_favorites_${userData.username}`);
+        }
+    } catch (e) {
+        // Ignore parse errors during cleanup
+    }
+    // Also remove any legacy global keys
+    localStorage.removeItem('oxicloud_recent_files');
+    localStorage.removeItem('oxicloud_favorites');
+    
     localStorage.removeItem(TOKEN_KEY);
     localStorage.removeItem(REFRESH_TOKEN_KEY);
     localStorage.removeItem(TOKEN_EXPIRY_KEY);