Make auth JWT-only for Capacitor WebView origins (#22) (#26)

## Summary
- Closes #22
- Drop CSRF cookie / `js-cookie` path; axios uses JWT `Authorization` only (`withCredentials: false`)
- Unified token storage: `localStorage` sync source of truth + optional Capacitor Preferences mirror/hydrate for native shells
- Request interceptor always attaches fresh bearer token; 401 refresh + sign-in redirect use hash-safe native paths
- Companion backend PR: `ai_ml_operations/chat_backend` branch `capacitor-cors-csrf-22` (CORS/CSRF Capacitor origins)

## Test plan
- [x] Unit tests: `tokenStorage`, `nativePlatform`, `jwtHelpers`, Auth/SignIn/WebSocket (`npm run test:ci`)
- [ ] Login from Capacitor Android (`https://localhost`) and iOS (`capacitor://localhost`)
- [ ] Token refresh after access expiry; logout blacklist; password reset; 401 → sign-in
- [ ] Confirm browser build at `chat.aimloperations.com` unchanged
- [ ] Merge companion backend PR so prod CORS includes Capacitor origins when `CORS_ORIGIN_ALLOW_ALL=false`Reviewed-on: #26

llm-fe/src/react-app-env.d.ts

@@ -1,16 +1,18 @@
 /// <reference types="react-scripts" />
 
+interface CapacitorPreferencesPlugin {
+  get?: (options: { key: string }) => Promise<{ value?: string | null }>;
+  set?: (options: { key: string; value: string }) => Promise<void>;
+  remove?: (options: { key: string }) => Promise<void>;
+}
+
 interface CapacitorBridge {
   isNativePlatform?: () => boolean;
   isNative?: boolean;
   Plugins?: {
+    Preferences?: CapacitorPreferencesPlugin;
     App?: { addListener?: (...args: unknown[]) => unknown };
     Network?: { addListener?: (...args: unknown[]) => unknown };
-    Preferences?: {
-      get?: (options: { key: string }) => Promise<{ value?: string | null }>;
-      set?: (options: { key: string; value: string }) => Promise<void>;
-      remove?: (options: { key: string }) => Promise<void>;
-    };
   };
 }