Drop CSRF cookie dependency (js-cookie), store tokens via localStorage with optional Capacitor Preferences mirror, and attach Authorization on every request so Android/iOS shells work without third-party cookies.