Cookie-based session model, admin role gate and 401 handling

[ykargeee-bit]

Summary

Implements the auth session hardening assigned to ykargeee-bit:

• The access token is kept in a JavaScript-readable cookie and fetches don't send credentials #1975 — Cookie-based session model: every fetch uses credentials: "include" with the backend's HttpOnly accessToken cookie; the js-cookie mirror and all bearer/token threading are removed from the client. The session store keeps only an in-memory copy of the login token plus the user. New GET /auth/me endpoint restores session/role after reload.
• 1973 — Admin role gate: middleware decodes the verified admin claim and redirects members to a new /admin/forbidden page; RequireAdmin rewritten as a session-driven client backstop with a not-authorised state.
• "Sign out" only deletes a JS cookie and never calls POST /auth/logout #1974 — Sign-out everywhere: new logout() (POST /auth/logout with credentials), shared useSignOut hook, and UserMenu on wallet, payments, usage, credits and admin headers.
• Expired or rejected tokens aren't handled globally, so users see raw API errors instead of being sent to log in #1977 — Central 401 handling: expireSession() clears the store, toasts once, and redirects to /login?returnTo=... with loop protection, wired into every *-api helper. Parallel 401s are coalesced via a module flag.

Backend changes

Limited to the new GET /auth/me endpoint (reads the guarded request user). Login/register/logout are untouched.

Test updates

• auth-form.test.tsx — setSession, role "user"
• payments-api.test.ts / credits-api.test.ts / wallet-api.test.ts — removed Bearer/Authorization assertions (no client-side bearer); wallet credentials expectation moved to include
• payment-return-page.test.tsx — user/status mock + bootstrap mock
• require-admin.test.tsx — rewritten for the role-based gate
• New: session-expiry.test.ts, auth-api.test.ts, api-401.test.ts, middleware.test.ts, app/payments/__tests__/page.test.tsx

Merge coordination

• Every API module repeats its own fetch wrapper and threads the access token through each call #1976 (devrabiuhussain) — both PRs touch the five *-api modules and their callers. Every API module repeats its own fetch wrapper and threads the access token through each call #1976 keeps an optional accessToken param for compatibility; this PR removes the parameter and headers entirely. Resolve in favor of this PR's cookie session semantics.
• Three overlapping provider files (lib/providers.tsx, lib/providers/providers.tsx, lib/query-provider.tsx) #1980 (Memplethee-lab) — query-client side of the 401 reaction (skip retries for 401/403) lands with the providers consolidation to avoid both PRs editing the same provider files.
• Pages read the auth cookie during render, causing hydration mismatches and non-reactive auth state #1983 (Akargi) — session-store and payments-pages overlap; this PR replaces the store wholesale, so Akargi's branch will need a rebase.

Closes #1975
Closes #1977
Closes #1974
Closes #1973

[vercel]

@ykargeee-bit is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@ykargeee-bit Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits