fix(auth): never persist refresh token to localStorage; rely on httpOnly cookie (Closes #898)

[waterWang]

Closes #898

Problem

The backend already sets the refresh token as an httpOnly, SameSite=strict cookie, but the frontend still referenced a finchippay_refresh_token localStorage key in several auth/wallet code paths. Any XSS could exfiltrate a token stored in localStorage, undermining exactly what the httpOnly cookie was designed to prevent.

Fix

• frontend/lib/auth.ts: getRefreshToken/setRefreshToken/clearJwtToken now only track a boolean finchippay_has_session session flag — the actual refresh token is never written to localStorage. Token refresh rides the backend httpOnly cookie via credentials: "include" on /api/auth/refresh.
• frontend/lib/wallet.ts: removed the redundant finchippay_refresh_token localStorage cleanup in disconnectWallet (logout already clears via clearAuthToken).
• Defence-in-depth: setRefreshToken/clearJwtToken still purge any legacy residual finchippay_refresh_token key left by earlier versions, so upgrading cleans old insecure data.

Tests

Added __tests__/auth.test.ts (8 tests) covering:

• No refresh token is ever written to localStorage.
• Session presence is tracked via a boolean flag, not the token value.
• clearJwtToken removes the session flag and purges residual keys.
• /api/auth/refresh is called with credentials: "include" and never sends the token as header/body.
• withAuth preemptively refreshes via the cookie when only a session flag exists.

All 8 tests pass.

Note: the existing sdk-instance.ts has a pre-existing backslash-escape corruption on main (introduced in the SDK auth PR) that breaks unrelated test suites; it is out of scope for this issue.

[github-actions]

🤖 Greptile AI Code Review

Greptile will automatically review this PR (3 file(s) changed).

Review gates:

• ✅ CodeQL Security Scan
• ✅ Custom rules (.greptile/config.json)
• ✅ Architecture guidelines (.greptile/rules.md)

To manually trigger a re-review, comment @greptileai on this PR.
To skip review, add the skip-review label.