feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

src/hooks/useLibrarySync.js

@@ -1,6 +1,6 @@
 import {useEffect, useRef, useState} from 'react';
 import {apiFetch} from '../utils/api.js';
-import {getToken} from '../utils/auth.js';
+import {hasSession} from '../utils/auth.js';
 
 const POLL_INTERVAL_MS = 3000;
 const MAX_POLL_DURATION_MS = 120_000;
@@ -34,7 +34,7 @@ export default function useLibrarySync({enabled, expectInitialSync = false, onCo
         const startedAt = Date.now();
 
         const fetchOnce = async () => {
-            if (!getToken()) return;
+            if (!hasSession()) return;
 
             try {
                 const response = await apiFetch(