feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

src/hooks/useSteamProfile.js

@@ -1,18 +1,18 @@
 import {useEffect, useState} from 'react';
 import {apiFetch} from '../utils/api.js';
-import {getToken} from '../utils/auth.js';
+import {sessionStamp} from '../utils/auth.js';
 
 /**
  * The user's Steam name and avatar from Core, or null while loading, without a Steam ID or on any error. Only
- * decoration, so a failed call shows the default icon and never ends the session. Loads again for a new token
- * (new Steam ID or another login) on the next render, e.g. the next navigation.
+ * decoration, so a failed call shows the default icon and never ends the session. Loads again after a new login
+ * or a settings save (see sessionStamp) on the next render, e.g. the next navigation.
  */
 export default function useSteamProfile(enabled) {
     const [profile, setProfile] = useState(null);
-    const token = getToken();
+    const stamp = sessionStamp();
 
     useEffect(() => {
-        if (!enabled || !token) {
+        if (!enabled || !stamp) {
             setProfile(null);
             return undefined;
         }
@@ -29,7 +29,7 @@ export default function useSteamProfile(enabled) {
         return () => {
             cancelled = true;
         };
-    }, [enabled, token]);
+    }, [enabled, stamp]);
 
     return profile;
 }