Session model
Short-lived session model
When a user connects, the backend issues random, short-lived proxy session secrets (~2 min TTL) that the extension auto-rotates. They are validated server-side with a keyed one-way digest and never stored as a reusable plaintext credential — separate from the account password.

