fix: cookie-based auth storage + Socket.IO status hook (#1500-#1503)

[Tarrii]

Minimal, additive changes addressing the four assigned issues.

• Many pages bypass lib/api-client and read the token from localStorage, so they miss 401 handling and token refresh #1500 migration helper so pages stop reading tokens from localStorage/lib/api-client directly
• Access and refresh tokens are stored in localStorage even though the backend already sets httpOnly cookies #1501 AUTH_COOKIE_MODE makes httpOnly cookies authoritative; legacy tokens are cleared
• Document detail page opens a raw WebSocket to /documents/:id/status, but the backend serves a Socket.IO namespace #1502 useDocumentStatusSocket connects via the Socket.IO /documents namespace, not a raw WebSocket
• The document page's WebSocket reconnect loop keeps running after the page is closed #1503 the hook disconnects on unmount, stopping the reconnect loop when the page closes

Issues

Closes #1500
Closes #1501
Closes #1502
Closes #1503

[vercel]

@BigBen-7 is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Tarrii Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits