feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

src/pages/GameLibrary.test.jsx

@@ -41,7 +41,7 @@ function renderLibrary(initialEntry = '/library') {
 const typeInto = (value) => fireEvent.change(screen.getByRole('searchbox'), {target: {value}});
 
 beforeEach(() => {
-    localStorage.setItem('tbp_jwt', 'token');
+    localStorage.setItem('tbp_session', '1');
     globalThis.fetch = vi.fn(async () => ({ok: true, status: 200, json: async () => page}));
 });