Fix auth session persistence with HttpOnly cookies and CSRF

frontend/src/App.tsx

@@ -20,7 +20,6 @@ import {
   deleteDocument,
   exportContentsMarkdown,
   getCurrentAuthSession,
-  getRuntimeApiToken,
   getAppSettings,
   listDocuments,
   listPaths,
@@ -30,7 +29,6 @@ import {
   loginWithPassword,
   logoutCurrentSession,
   resetAppSettings,
-  setRuntimeApiToken,
   searchDocuments,
   trashDocument,
   updateAppSettings,
@@ -161,21 +159,19 @@ export default function App(): JSX.Element {
   }, []);
 
   /**
-   * Exchanges submitted credentials for server-issued bearer session and activates app shell.
+   * Exchanges submitted credentials for a server-issued session and activates the app shell.
    */
   const handleLogin = useCallback(async (username: string, password: string): Promise<void> => {
     setIsAuthenticating(true);
     setAuthError(null);
     try {
       const payload = await loginWithPassword(username, password);
-      setRuntimeApiToken(payload.access_token);
       setAuthUser(payload.user);
       setAuthPhase('authenticated');
       setError(null);
     } catch (caughtError) {
       const message = caughtError instanceof Error ? caughtError.message : 'Login failed';
       setAuthError(message);
-      setRuntimeApiToken(null);
       setAuthUser(null);
       setAuthPhase('unauthenticated');
       resetApplicationState();
@@ -192,7 +188,6 @@ export default function App(): JSX.Element {
     try {
       await logoutCurrentSession();
     } catch {}
-    setRuntimeApiToken(null);
     setAuthUser(null);
     setAuthError(null);
     setAuthPhase('unauthenticated');
@@ -303,13 +298,6 @@ export default function App(): JSX.Element {
   }, [isAdmin]);
 
   useEffect(() => {
-    const existingToken = getRuntimeApiToken();
-    if (!existingToken) {
-      setAuthPhase('unauthenticated');
-      setAuthUser(null);
-      return;
-    }
-
     const resolveSession = async (): Promise<void> => {
       try {
         const sessionPayload = await getCurrentAuthSession();
@@ -317,7 +305,6 @@ export default function App(): JSX.Element {
         setAuthError(null);
         setAuthPhase('authenticated');
       } catch {
-        setRuntimeApiToken(null);
         setAuthUser(null);
         setAuthPhase('unauthenticated');
         resetApplicationState();