Fix auth invalidation during batch transcription

[ComputelessComputer]

Summary

• Preserve the existing persisted session when Supabase refresh or transient account verification fails.
• Synchronize explicit logout across every app window while continuing to ignore unsolicited SDK sign-out events.
• Refresh Anarlog Cloud credentials before batch transcription and fall back to a still-valid current token when lookup or refresh is unavailable.

Validation

• pnpm -F desktop test (431 files, 3695 tests)
• pnpm -F desktop typecheck
• pnpm fmt:check
• pnpm exec oxlint --quiet --format=github apps/desktop/src/ (0 errors)

---

Note

High Risk
Broad changes to authentication persistence, multi-window sign-out, and when sessions are cleared—security-sensitive behavior with intentional relaxation of SDK-driven logout.

Overview
Fixes unexpected logouts during batch transcription and fragile Supabase refresh by making the desktop app own session persistence and treat SDK sign-out as non-authoritative unless the user (or main window) commits logout.

Session storage and startup: Tauri auth storage blocks the Supabase client from removing the primary session key; sessions are read back on cold start. Initial load falls back to the persisted session when getSession fails or returns empty, instead of clearing storage on “fatal” refresh errors (isFatalSessionError is removed).

Auth provider behavior: Unsolicited SIGNED_OUT from the SDK is ignored; explicit sign-out still runs the existing main/secondary coordination and now broadcasts anlg:auth-sign-out-committed so other windows clear only after a real logout. Transient cloudsync account verification failures keep the in-memory session rather than wiping auth.

API calls: New getSessionForRequest resolves a token for outbound requests (SDK lookup, proactive refresh within ~2 minutes, offline fallbacks). Batch transcription uses it for Anarlog Cloud / paid paths so jobs start with a fresh access token (existing 401 retry unchanged).

^{Reviewed by Cursor Bugbot for commit e31af0f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[netlify]

✅ Deploy Preview for anarlog canceled.

Name	Link
🔨 Latest commit	e31af0f
🔍 Latest deploy log	https://app.netlify.com/projects/anarlog/deploys/6a9843b8635e5400087d0ac8

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 7068729. Configure here.}