feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

src/components/BacklogCard.jsx

@@ -13,7 +13,7 @@ import {cn} from '@/lib/utils';
 import {STATUS_META} from './GameStatusBadge.jsx';
 import {GAME_PRIORITIES, GAME_STATUSES, NO_PRIORITY, saveBacklogEntry, toBacklogRequest} from '../utils/backlog.js';
 import useSessionExpired from '../hooks/useSessionExpired.js';
-import {getToken} from '../utils/auth.js';
+import {hasSession} from '../utils/auth.js';
 
 const NOTES_MAX = 2000;
 
@@ -42,7 +42,7 @@ export default function BacklogCard({game, onSaved}) {
     const set = (field) => (value) => setForm((f) => ({...f, [field]: value}));
 
     const save = async () => {
-        if (!getToken()) {
+        if (!hasSession()) {
             navigate('/login');
             return;
         }

src/components/BacklogCard.test.jsx

@@ -12,7 +12,7 @@ const saveButton = () => screen.getByRole('button', {name: 'BACKLOG.SAVE'});
 
 describe('BacklogCard', () => {
     beforeEach(() => {
-        localStorage.setItem('tbp_jwt', 'token');
+        localStorage.setItem('tbp_session', '1');
         globalThis.fetch = vi.fn(async (url, init) => ({ok: true, status: 200, json: async () => JSON.parse(init.body)}));
     });
 

src/components/CompletedHint.test.jsx

@@ -12,7 +12,7 @@ const renderHint = (props) => render(<MemoryRouter><CompletedHint game={game} on
 
 describe('CompletedHint', () => {
     beforeEach(() => {
-        localStorage.setItem('tbp_jwt', 'token');
+        localStorage.setItem('tbp_session', '1');
         globalThis.fetch = vi.fn(async (url, init) => ({
             ok: true, status: 200, json: async () => ({...JSON.parse(init.body), rating: 5, notes: 'keep', priority: null}),
         }));

src/components/PlayingHint.test.jsx

@@ -12,7 +12,7 @@ const renderHint = (props) => render(<MemoryRouter><PlayingHint game={game} onCh
 
 describe('PlayingHint', () => {
     beforeEach(() => {
-        localStorage.setItem('tbp_jwt', 'token');
+        localStorage.setItem('tbp_session', '1');
         globalThis.fetch = vi.fn(async (url, init) => ({ok: true, status: 200, json: async () => JSON.parse(init.body)}));
     });