refactor(frontend): lint, one session guard, one request helper, one user context

src/utils/auth.js

@@ -1,6 +1,6 @@
 // The tokens live in HttpOnly cookies that no script can read. This flag only remembers that a login happened; a
 // stale flag costs one 401 and a failed refresh, then the login page opens.
-const SESSION_KEY = 'tbp_session';
+export const SESSION_KEY = 'tbp_session';
 // Where the token lived before the cookies. Removed on the next login or logout.
 const LEGACY_TOKEN_KEY = 'tbp_jwt';