[codex] harden auth token persistence

[saurabhhhcodes]

What changed

• Switched the persisted auth store from localStorage to sessionStorage so the JWT is no longer readable from localStorage.getItem("auth-storage").
• Kept login/logout behavior and bearer-token injection unchanged.
• Aligned a small frontend build issue so the auth page and document listing code still typecheck cleanly.

Validation

• git diff --check
• npm run build in frontend/

Closes #930