Auth flow updated.

- ✓ **changes**
  - auth.ts refresh logic
  - session.ts expiry handling
  - api.ts retry on 401
- ✓ **verification**
  - tests 42/42
- ⚠ **remaining**
  - mobile client untouched