feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

README.md

@@ -34,6 +34,8 @@ To Be Played is split into three repositories:
 - **Appearance**: accent color, corner style, wide layout, page background and banner from your own game art.
   Saved in Auth, so it follows you to every device.
 - German and English, dark mode, mobile layout, session-expired message instead of a silent logout.
+- **Session**: the tokens are HttpOnly cookies that no script can read. `apiFetch` renews an expired access token
+  once and sends the request again; parallel requests and other tabs share one refresh.
 
 ## Tech stack
 
@@ -85,8 +87,7 @@ npm run build
 ## Roadmap
 
 - Mood filter for "What to play next".
-- Move the JWT from `localStorage` to an httpOnly cookie (needs Auth changes) and add a Content Security Policy in
-  `nginx.conf`.
+- A Content Security Policy in `nginx.conf`.
 - Installable PWA.
 
 ## License