feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

src/App.jsx

@@ -18,7 +18,8 @@ import {Toaster} from '@/components/ui/sonner';
 import {TooltipProvider} from '@/components/ui/tooltip';
 import PageBackground from './components/PageBackground.jsx';
 import {usePreferences} from './context/PreferencesContext.jsx';
-import {clearToken, getToken} from './utils/auth.js';
+import {clearSession, hasSession} from './utils/auth.js';
+import {logout} from './utils/api.js';
 
 function App() {
     const {t} = useTranslation();
@@ -32,7 +33,7 @@ function App() {
     useEffect(() => {
         // No local expiry check here: a 401 from the backend ends the session (useSessionExpired), and a browser
         // clock that runs ahead would otherwise end it silently.
-        setIsAuthenticated(!!getToken());
+        setIsAuthenticated(hasSession());
     }, [location]);
 
     // On login and on page load; the cached look shows until Auth answers.
@@ -40,8 +41,10 @@ function App() {
         if (isAuthenticated) syncAppearance();
     }, [isAuthenticated, syncAppearance]);
 
-    const handleLogout = () => {
-        clearToken();
+    // Waits for Auth: a late logout answer would clear the cookies of a login that came after it.
+    const handleLogout = async () => {
+        await logout();
+        clearSession();
         resetAppearance();
         setIsAuthenticated(false);
         navigate('/login');