Local sessions are lost after refresh and authenticated controls disappear

[angelo-lacson]

Summary

In local username/password deployments (REACT_APP_USE_AUTH0=false), the JWT
and user identity are held only in Apollo reactive variables. A full browser
refresh clears those in-memory values, so the application renders the user as
anonymous even though they logged in successfully moments earlier.

This also hides authenticated controls that gate exclusively on userObj,
including document upload, Add to Corpus, and corpus-management actions.

Reproduction

1. Start the local full-stack Docker profile.
2. Log in through the local username/password form.
3. Confirm that authenticated navigation and document-management controls are
   visible.
4. Refresh the browser.

Actual behavior

• The navigation renders Login.
• Authenticated document and corpus controls disappear.
• Depending on query timing, the frontend may report that user details could
  not be loaded.
• A 403 Forbidden response from an operation for which the user lacks
  permission clears the entire authentication state, even though the token is
  still valid.

Expected behavior

• A local login remains usable across refreshes for a bounded period.
• Restored sessions populate authenticated navigation and management controls
  while canonical backend-user details load.
• Logout, expiry, 401, and UNAUTHENTICATED responses clear the session.
• A normal 403 authorization denial does not log the user out.

Proposed scope

• Persist local JWT sessions with an explicit 24-hour client-side TTL.
• Restore the session before child components issue authenticated queries.
• Clear persisted state on logout, expiry, and genuine authentication errors.
• Accept either the restored local identity or backend user for UI auth gates.
• Add focused unit coverage for persistence, expiry, logout, and 401/403
  handling.

Related issues

• Signal to Frontend When Token is Stale #744 tracks stale-token signaling, primarily for Auth0.
• Local version: Could not get details from local server Error #2104 reports a similar local-deployment symptom where backend-user loading
  fails and upload controls are unavailable.