Add full shell, replaceable Omics adapter and bilingual interaction

Implement approved specification #32 and tickets #33-#37. Keep host authentication server-verified and pin session interaction language. Compile scoped base selectors for browser compatibility and retain full gutters during CSS pruning.

frontend/src/auth/authState.ts

@@ -2,6 +2,7 @@ import { useSyncExternalStore } from "react";
 import type { AuthenticatedUser } from "../api/types";
 import { queryClient } from "../app/queryClient";
 import { useSessionStore } from "../store/sessionStore";
+import { rememberSession } from "../shell/host/rememberedSession";
 
 let current: AuthenticatedUser | null = null;
 let generation = 0;
@@ -22,13 +23,28 @@ export function getAuthState(): AuthenticatedUser | null {
 }
 
 export function setAuthState(user: AuthenticatedUser): void {
+  if (current && (current.issuer !== user.issuer || current.subject !== user.subject)) rememberSession(current, null);
   scrubUserBoundState();
   current = user;
   generation += 1;
   notify();
 }
 
+/** Refresh expiry/CSRF metadata without discarding the current user's work. */
+export function refreshAuthState(user: AuthenticatedUser): void {
+  if (!current || current.issuer !== user.issuer || current.subject !== user.subject
+    || current.isAdmin !== user.isAdmin
+    || JSON.stringify([...current.permissions].sort()) !== JSON.stringify([...user.permissions].sort())
+    || JSON.stringify([...current.roles].sort()) !== JSON.stringify([...user.roles].sort())) {
+    setAuthState(user);
+    return;
+  }
+  current = user;
+  notify();
+}
+
 export function clearAuthState(): void {
+  if (current) rememberSession(current, null);
   scrubUserBoundState();
   current = null;
   generation += 1;