refactor(session): one session store for login, logout and 401

README.md

@@ -128,14 +128,19 @@ flowchart LR
 - Calls for the logged-in user go through `src/utils/api.js`. `clientFetch` sends the HttpOnly cookies and the
   `X-TBP-Client` header. `apiFetch` answers a `401` with one `POST /api/auth/refresh` and sends the request again.
   Parallel requests and other tabs share this refresh (`navigator.locks`). When the second answer is still a
-  `401`, `apiFetch` fires `expired`; the pages only stop. `request()` wraps `apiFetch` as `{ok, status, data}`
-  and never throws. Public pages (landing page, public profile) and the public `GET /api/version` in the settings
-  use plain `fetch`.
+  `401`, `apiFetch` ends the session (`expireSession`); the pages only stop. `request()` wraps `apiFetch` as
+  `{ok, status, data}` and never throws. Public pages (landing page, public profile) and the public
+  `GET /api/version` in the settings use plain `fetch`.
+- `src/utils/auth.js` is the session store: `markSession`, `clearSession` (logout) and `expireSession` (a `401`)
+  tell every `useSession()`, also on a login or logout in another tab. The user (`CurrentUserProvider`) and the
+  look (`PreferencesProvider`) follow it.
 - The pages that need a login sit under the `RequireSession` layout route in `App.jsx`. Without a session it opens
-  the login page, which comes back to the same page; on `expired` it ends the session (`useSessionExpired`). A
-  `401` on a public page ends nothing.
+  the login page: after a `401` with the "session expired" message and back to the same page, after a logout
+  without a way back. A public page stays open when the session ends there.
 - `CurrentUserProvider` holds `GET /api/users/me` for the whole app (`useCurrentUserContext`, `useCurrentUser`).
   Dashboard and settings load it again when they open.
+- Tests render through `src/test/renderWithProviders.jsx` (a data router like `main.jsx`) and answer requests
+  with `src/test/fetchRoutes.js`, which fails a test on any request without a route.
 - `src/utils/brokenImages.js` reports pictures that fail to load (`GameCover`, achievement icons on the game
   detail page) to Core.
 - `useLibrarySync` polls Core's `/api/library/sync-status` while a Steam sync runs, then loads the data again.