Improve auth session handling

[rishabhcli]

Summary

• import and use the auth session utilities directly in the app, showing the login control by default and wiring authentication callbacks
• add startup auth refresh handling that initializes the user menu when tokens refresh and resets to a sign-in prompt with a toast on failure
• expose auth session helpers for checking stored refresh tokens and clearing persisted state

Testing

• CI=1 npm test (fails: missing DATABASE_URL/JWT secrets and existing AnalyticsAggregator computeDensityGrid normalization failure)

---

Codex Task

[Copilot]

Pull Request Overview

This PR refactors authentication session handling by moving from a lazy-loading architecture to direct imports and implementing explicit startup auth initialization. The changes improve control over the authentication flow by separating session initialization from the AuthSession constructor and handling it in the App class.

Key Changes:

• Direct imports of auth modules (AuthSession, CloudSyncService, AuthModal, UserMenu, Dashboard) instead of lazy-loading
• New initializeAuthState() method that handles startup token refresh with proper error handling and user feedback
• Exposed helper methods in AuthSession (hasRefreshToken(), clearSessionState()) to support the new initialization flow

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/ui/App.ts	Adds direct auth module imports, implements initializeAuthState() for startup authentication with token refresh and error handling, shows login button by default
src/lib/auth/session.ts	Removes automatic token refresh from constructor, adds hasRefreshToken() and clearSessionState() helper methods for external session management

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

[nitpick] The clearSessionState() method is a redundant wrapper around clearSession(). Since clearSession() is already a private method and clearSessionState() just calls it directly without any additional logic, this adds unnecessary indirection.

Consider either:

1. Making clearSession() public and removing clearSessionState()
2. Or adding meaningful documentation to explain why the wrapper exists (e.g., if it's part of a public API contract)

Currently, clearSessionState() doesn't add value over directly exposing clearSession().

[Copilot]

[nitpick] The removed comments indicated these modules were previously intended for lazy loading to reduce initial bundle size. By importing them directly, these modules (AuthSession, CloudSyncService, AuthModal, UserMenu, Dashboard) are now included in the main bundle, which increases the initial bundle size.

Consider whether lazy loading is still desirable for these modules. If authentication and cloud features are not needed by all users immediately, code splitting could improve initial load performance. For example:

// Lazy load auth modules when needed
const { AuthSession } = await import('../lib/auth/session');
const { AuthModal } = await import('./components/auth/AuthModal');

If the decision to remove lazy loading is intentional (e.g., for simpler code or because these features are always needed), consider updating documentation to reflect this architectural decision.

Suggested change

	import { AuthSession } from '../lib/auth/session';
	import { CloudSyncService } from '../lib/cloud/sync';
	import { AuthModal } from './components/auth/AuthModal';
	import { UserMenu } from './components/auth/UserMenu';
	import { Dashboard } from './components/Dashboard';
	import { loadPdf, renderPageToCanvas, getPageCount } from '../lib/pdf/load';