feat(core): improve login flow (#15219)

#### PR Dependency Tree


* **PR #15219** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added secure, automatic auth session token refresh and request replay
for expired-token responses across Android, iOS, and Electron.
* Updated sign-in flows to manage sessions without returning tokens to
the app layer.
* Added “Devices” management UI with sign out per device and sign out
all.
  * Enabled support for both Hashcash and Turnstile captcha providers.
* **Bug Fixes**
* Improved refresh de-duplication, inflight cancellation/clear behavior,
and recovery from corrupted/invalid sessions.
* **Tests**
* Expanded auth-session, refresh/revoke, and replay coverage (Electron
unit tests, Android instrumentation tests, iOS auth date parser tests).
* **Chores**
* Removed CAPTCHA site key from build-time configuration and adjusted CI
test execution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/apps/electron-renderer/src/app/effects/modules.ts

@@ -122,6 +122,9 @@ export function setupModules() {
       async signOut() {
         await apis.handler.auth.signOut(endpoint);
       },
+      async clearSession() {
+        await apis.handler.auth.clearSession(endpoint);
+      },
     };
   });
 

packages/frontend/apps/electron-renderer/src/background-worker/index.ts

@@ -24,11 +24,11 @@ bindNativeDBV1Apis(apis!.db);
 configureSocketAuthMethod((endpoint, cb) => {
   // oxlint-disable-next-line no-non-null-assertion
   apis!.auth
-    .readEndpointToken(endpoint)
+    .getValidAccessToken(endpoint)
     .then(({ token }: { token?: string | null }) => {
       cb(token ? { token, tokenType: 'jwt' } : {});
     })
-    .catch(() => cb({}));
+    .catch(() => cb({ error: 'AUTH_SESSION_TEMPORARILY_UNAVAILABLE' }));
 });
 
 const storeManager = new StoreManagerConsumer([