fix(frontend): restore local sessions after refresh

[angelo-lacson]

Summary

Fixes #2289.

Local username/password sessions now survive a full browser refresh for up to
24 hours, and authenticated navigation plus document/corpus controls remain
available while canonical backend-user details load.

This also corrects authentication error classification: 401,
UNAUTHENTICATED, expired JWTs, and explicit logout clear persisted state;
ordinary 403 Forbidden permission responses preserve the valid session.

Root cause

Local authentication state lived only in Apollo reactive variables. Refreshing
the page reset the JWT and user identity before child components mounted and
issued GraphQL queries. Several UI gates also treated userObj as the sole
proof of authentication, even after backendUserObj had been populated.

Separately, the Apollo error link treated every 403 as an invalid token,
conflating authorization failure with authentication failure.

Changes

• Add a small local-session utility with a fixed 24-hour TTL and defensive
  handling for unavailable, malformed, or expired browser storage.
• Restore the token and display identity in AuthGate before authenticated
  children mount.
• Save on successful local login and clear on logout or genuine authentication
  failure.
• Use the restored/backend identity when rendering navigation and authenticated
  document/corpus actions.
• Preserve session state on GraphQL and network-level 403 responses.
• Add focused tests covering restoration, identity, expiry, logout, and
  401/403 behavior.

Auth0 behavior is unchanged. The client TTL does not extend the JWT's own
server-enforced lifetime.

Verification

• docker compose -f local.yml --profile fullstack build frontend
• yarn test:unit --run src/utils/localAuthSession.test.ts src/graphql/errorLink.test.ts
  • 2 test files passed
  • 14 tests passed
• python3 scripts/collate_changelog.py --check
• git diff --check

Manual local-Docker verification:

• Login survives a hard refresh.
• Navigation restores the authenticated user rather than showing Login.
• Upload, Add to Corpus, and corpus-management actions remain visible.
• Logout clears the persisted session.
• A permission-denied 403 does not sign the user out.

Related

• Signal to Frontend When Token is Stale #744 — stale/expired-token signaling (Auth0-oriented)
• Local version: Could not get details from local server Error #2104 — similar local-deployment user-detail and upload-control symptoms

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[angelo-lacson]

I have read the CLA document and I hereby sign the CLA