Make auth JWT-only for Capacitor WebView origins (#22) (#26)

## Summary
- Closes #22
- Drop CSRF cookie / `js-cookie` path; axios uses JWT `Authorization` only (`withCredentials: false`)
- Unified token storage: `localStorage` sync source of truth + optional Capacitor Preferences mirror/hydrate for native shells
- Request interceptor always attaches fresh bearer token; 401 refresh + sign-in redirect use hash-safe native paths
- Companion backend PR: `ai_ml_operations/chat_backend` branch `capacitor-cors-csrf-22` (CORS/CSRF Capacitor origins)

## Test plan
- [x] Unit tests: `tokenStorage`, `nativePlatform`, `jwtHelpers`, Auth/SignIn/WebSocket (`npm run test:ci`)
- [ ] Login from Capacitor Android (`https://localhost`) and iOS (`capacitor://localhost`)
- [ ] Token refresh after access expiry; logout blacklist; password reset; 401 → sign-in
- [ ] Confirm browser build at `chat.aimloperations.com` unchanged
- [ ] Merge companion backend PR so prod CORS includes Capacitor origins when `CORS_ORIGIN_ALLOW_ALL=false`Reviewed-on: #26

llm-fe/package-lock.json

@@ -23,7 +23,6 @@
         "bootstrap": "^5.3.3",
         "chroma-js": "^3.1.2",
         "formik": "^2.4.6",
-        "js-cookie": "^3.0.5",
         "jwt-decode": "^4.0.0",
         "lodash": "^4.17.21",
         "markdown-to-jsx": "^7.7.2",
@@ -12814,14 +12813,6 @@
         "jiti": "bin/jiti.js"
       }
     },
-    "node_modules/js-cookie": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/js-cookie/-/js-cookie-3.0.5.tgz",
-      "integrity": "sha512-cEiJEAEoIbWfCZYKWhVwFuvPX1gETRYPw6LlaTKoxD3s2AkXzkCjnp6h0V77ozyqj0jakteJ4YqDJT830+lVGw==",
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/js-tokens": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",