auth: use sessions

lib/features/auth/login_page.dart

@@ -48,9 +48,12 @@ class _LoginPageState extends State<LoginPage> {
 
   /// Attempts to auto-login using a stored JWT token.
   Future<void> _tryAutoLogin() async {
-    final jwt = await _storageService.readSecure(SecureStorageKey.jwt);
+    final refreshToken = await _storageService.readSecure(
+      SecureStorageKey.refreshToken,
+    );
 
-    if (jwt != null && _isTokenValid(jwt)) {
+    if (refreshToken != null) {
+      // TODO: this assumes the refresh token is always valid
       await _navigateToHome();
       return;
     }
@@ -71,7 +74,9 @@ class _LoginPageState extends State<LoginPage> {
   /// Restores previously saved URL and username for convenience.
   Future<void> _restoreCredentials() async {
     final url = await _storageService.readSecure(SecureStorageKey.url);
-    final username = await _storageService.readSecure(SecureStorageKey.email);
+    final username = await _storageService.readSecure(
+      SecureStorageKey.username,
+    );
 
     if (url != null) _urlController.text = url;
     if (username != null) _usernameController.text = username;
@@ -96,7 +101,7 @@ class _LoginPageState extends State<LoginPage> {
       await apiClient.login(_usernameController.text, _passwordController.text);
 
       // Save credentials for next time
-      await _saveCredentials(apiClient.token!);
+      await _saveCredentials(apiClient.refreshToken!);
       await _navigateToHome();
     } catch (e) {
       _log.warning('Login failed', e);
@@ -111,14 +116,17 @@ class _LoginPageState extends State<LoginPage> {
   }
 
   /// Saves credentials after successful login.
-  Future<void> _saveCredentials(String token) async {
+  Future<void> _saveCredentials(String refreshToken) async {
     await _storageService.writeSecure(
       SecureStorageKey.url,
       _urlController.text,
     );
-    await _storageService.writeSecure(SecureStorageKey.jwt, token);
     await _storageService.writeSecure(
-      SecureStorageKey.email,
+      SecureStorageKey.refreshToken,
+      refreshToken,
+    );
+    await _storageService.writeSecure(
+      SecureStorageKey.username,
       _usernameController.text,
     );
   }