feat(core): improve login flow (#15219)

#### PR Dependency Tree


* **PR #15219** 👈

This tree was auto-generated by
[Charcoal](https://github.com/danerwilliams/charcoal)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added secure, automatic auth session token refresh and request replay
for expired-token responses across Android, iOS, and Electron.
* Updated sign-in flows to manage sessions without returning tokens to
the app layer.
* Added “Devices” management UI with sign out per device and sign out
all.
  * Enabled support for both Hashcash and Turnstile captcha providers.
* **Bug Fixes**
* Improved refresh de-duplication, inflight cancellation/clear behavior,
and recovery from corrupted/invalid sessions.
* **Tests**
* Expanded auth-session, refresh/revoke, and replay coverage (Electron
unit tests, Android instrumentation tests, iOS auth date parser tests).
* **Chores**
* Removed CAPTCHA site key from build-time configuration and adjusted CI
test execution.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

packages/frontend/apps/mobile-shared/src/auth/endpoint.spec.ts

@@ -0,0 +1,16 @@
+import { describe, expect, test } from 'vitest';
+
+import { canonicalAuthEndpoint } from './endpoint';
+
+describe('canonicalAuthEndpoint', () => {
+  test.each([
+    ['https://AFFINE.PRO/path?query=1', 'https://affine.pro'],
+    ['https://affine.pro:443', 'https://affine.pro'],
+    ['http://localhost:80/path', 'http://localhost'],
+    ['http://localhost:8080/path', 'http://localhost:8080'],
+    ['capacitor://localhost/path', 'capacitor://localhost/path'],
+    ['invalid endpoint', 'invalid endpoint'],
+  ])('normalizes %s', (endpoint, expected) => {
+    expect(canonicalAuthEndpoint(endpoint)).toBe(expected);
+  });
+});

packages/frontend/apps/mobile-shared/src/auth/endpoint.ts

@@ -0,0 +1,10 @@
+export function canonicalAuthEndpoint(endpoint: string) {
+  try {
+    const url = new URL(endpoint);
+    return url.protocol === 'http:' || url.protocol === 'https:'
+      ? url.origin
+      : endpoint;
+  } catch {
+    return endpoint;
+  }
+}

packages/frontend/apps/mobile-shared/src/index.ts

@@ -1 +1,2 @@
+export * from './auth/endpoint';
 export * from './nbstore/payload';