API: auth: don't include token in JSON objects

Token is already sent by Set-Cookie. It is unneccessary and
insecure to include them in JSON response. Doing so also
introduce the token into Javascript VM which is not protected
as well as the httpOnly cookies.

shared/schema/api/auth.ts

@@ -11,7 +11,6 @@ export type AuthAuthenticationOptions = Required<z.infer<typeof authAuthenticati
 // POST /api/auth/authenticate - success response
 export interface AuthAuthenticationResponse {
   success: boolean;
-  token: string;
   username: string;
   level: AccessLevel;
 }