auth: a sign-out during a renewal must not write half a session

`{ ..._auth }` after the await spreads a null _auth to {}, so the renewal
stored a token with no username and no userId. The app renders the
signed-in interface from that and throws on user.username[0] — a blank
page on every load, in localStorage, until the site's data is cleared.

The sign-out wins the race now, and loadAuth treats an identity-less
object as signed out so a browser already holding one heals itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions