feat(auth): use the cookie session and refresh on 401

The token is no longer stored; a tbp_session flag remembers the
login. apiFetch renews the session once on a 401 and sends the
request again. Parallel requests and other tabs share one refresh,
because Auth revokes the session when a refresh token is used twice.
Only a 401 from the refresh ends the session; a 502 or no network
shows the normal error.

src/pages/LoginPage.test.jsx

@@ -6,9 +6,6 @@ import LoginPage from './LoginPage.jsx';
 
 vi.mock('react-i18next', () => import('../test/i18n-mock.js'));
 
-const b64 = (o) => btoa(JSON.stringify(o)).replace(/=+$/, '');
-const TOKEN = `${b64({alg: 'EdDSA'})}.${b64({exp: Math.floor(Date.now() / 1000) + 3600})}.sig`;
-
 function CurrentPath() {
     const location = useLocation();
     return <div data-testid="path">{location.pathname + location.search}</div>;
@@ -33,7 +30,7 @@ function submit() {
 
 describe('LoginPage', () => {
     beforeEach(() => {
-        globalThis.fetch = vi.fn(async () => ({ok: true, status: 200, json: async () => ({token: TOKEN})}));
+        globalThis.fetch = vi.fn(async () => ({ok: true, status: 200, json: async () => ({message: 'Login successful'})}));
     });
 
     afterEach(() => {
@@ -59,7 +56,11 @@ describe('LoginPage', () => {
         submit();
 
         await waitFor(() => expect(screen.getByTestId('path').textContent).toBe('/library?status=PLAYING'));
-        expect(localStorage.getItem('tbp_jwt')).toBe(TOKEN);
+        expect(localStorage.getItem('tbp_session')).not.toBeNull();
+        expect(fetch).toHaveBeenCalledWith(expect.stringContaining('/api/auth/login'), expect.objectContaining({
+            credentials: 'include',
+            headers: expect.objectContaining({'X-TBP-Client': 'web'}),
+        }));
     });
 
     it('ignores a return path outside the app', async () => {