auth: use sessions

lib/features/auth/login_page.dart

@@ -48,9 +48,12 @@ class _LoginPageState extends State<LoginPage> {
 
   /// Attempts to auto-login using a stored JWT token.
   Future<void> _tryAutoLogin() async {
-    final jwt = await _storageService.readSecure(SecureStorageKey.jwt);
+    final refreshToken = await _storageService.readSecure(
+      SecureStorageKey.refreshToken,
+    );
 
-    if (jwt != null && _isTokenValid(jwt)) {
+    if (refreshToken != null) {
+      // TODO: this assumes the refresh token is always valid
       await _navigateToHome();
       return;
     }
@@ -71,7 +74,9 @@ class _LoginPageState extends State<LoginPage> {
   /// Restores previously saved URL and username for convenience.
   Future<void> _restoreCredentials() async {
     final url = await _storageService.readSecure(SecureStorageKey.url);
-    final username = await _storageService.readSecure(SecureStorageKey.email);
+    final username = await _storageService.readSecure(
+      SecureStorageKey.username,
+    );
 
     if (url != null) _urlController.text = url;
     if (username != null) _usernameController.text = username;
@@ -96,7 +101,7 @@ class _LoginPageState extends State<LoginPage> {
       await apiClient.login(_usernameController.text, _passwordController.text);
 
       // Save credentials for next time
-      await _saveCredentials(apiClient.token!);
+      await _saveCredentials(apiClient.refreshToken!);
       await _navigateToHome();
     } catch (e) {
       _log.warning('Login failed', e);
@@ -111,14 +116,17 @@ class _LoginPageState extends State<LoginPage> {
   }
 
   /// Saves credentials after successful login.
-  Future<void> _saveCredentials(String token) async {
+  Future<void> _saveCredentials(String refreshToken) async {
     await _storageService.writeSecure(
       SecureStorageKey.url,
       _urlController.text,
     );
-    await _storageService.writeSecure(SecureStorageKey.jwt, token);
     await _storageService.writeSecure(
-      SecureStorageKey.email,
+      SecureStorageKey.refreshToken,
+      refreshToken,
+    );
+    await _storageService.writeSecure(
+      SecureStorageKey.username,
       _usernameController.text,
     );
   }

lib/features/home/home_page.dart

@@ -103,9 +103,11 @@ class _HomePageState extends State<HomePage> with RouteAware {
 
   Future<SyncResult> _loadSheets() async {
     final url = await _storageService.readSecure(SecureStorageKey.url);
-    final jwt = await _storageService.readSecure(SecureStorageKey.jwt);
+    final refreshToken = await _storageService.readSecure(
+      SecureStorageKey.refreshToken,
+    );
 
-    _apiClient = ApiClient(baseUrl: url!, token: jwt);
+    _apiClient = ApiClient(baseUrl: url!, refreshToken: refreshToken);
     _syncService = SyncService(
       apiClient: _apiClient!,
       storageService: _storageService,
@@ -169,6 +171,7 @@ class _HomePageState extends State<HomePage> with RouteAware {
 
   Future<void> _handleLogout() async {
     await _storageService.clearAllUserData();
+    await _apiClient!.logout();
 
     if (!mounted) return;