Drop the control token left under the old localStorage key

The key is named after the product, so the rename left every browser
with a token under `gittally.controlToken`, which nothing reads any more
and which "forget token" can no longer reach. It is a write-scope token
in a browser store, not a password, but a secret nobody owns is worth
one line to remove.

Removed on load. The token on the server is unchanged, so re-entering it
once per browser is all the rename costs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/main/resources/static/werkator.js

@@ -105,6 +105,16 @@ const giteaRepoUrl = metaContent("werkator-gitea-repo-url");
 // it is kept in localStorage and only ever sent as a request header.
 const CONTROL_TOKEN_KEY = "werkator.controlToken";
 
+// The key was named after the old product name, so the rename left every browser
+// with a token under a name nothing reads any more — a secret that not even
+// "forget token" can reach. Dropped on load; the token itself is unchanged on the
+// server, so the one re-entry per browser is all the rename costs.
+try {
+    window.localStorage.removeItem("gittally.controlToken");
+} catch (error) {
+    // localStorage unavailable (private mode, blocked cookies) — nothing stored, nothing to drop
+}
+
 function storedControlToken() {
     try {
         return window.localStorage.getItem(CONTROL_TOKEN_KEY) || "";