fix(auth): Session-Restore erst mit vollständiger lokaler Session

Stellt hasUnlockedLocalSession für UI-Wiederherstellung und
enforceUnlockedSession wieder her; persistSessionUserId setzt userId
nur bei Angabe in der Server-Antwort.

Co-authored-by: Cursor <cursoragent@cursor.com>

client/src/services/auth.ts

@@ -56,6 +56,13 @@ export function hasUnlockedLocalSession(): boolean {
   return hasUnlockedLocalCrypto() && !!localStorage.getItem('active_userid')
 }
 
+/** Persist server session user id when the /session response includes it. */
+export function persistSessionUserId(userId: string | undefined): void {
+  if (userId) {
+    localStorage.setItem('active_userid', userId)
+  }
+}
+
 export async function reauthWithPasskey(): Promise<boolean> {
   const options = await apiJson<any>(`${API_BASE}/reauth-options`, {
     method: 'POST'

client/src/services/authSession.test.ts

@@ -32,3 +32,22 @@ describe('local session unlock checks', () => {
     expect(hasUnlockedLocalCrypto()).toBe(false)
   })
 })
+
+describe('persistSessionUserId', () => {
+  beforeEach(() => {
+    localStorage.clear()
+  })
+
+  it('stores userId when provided', async () => {
+    const { persistSessionUserId } = await import('./auth.js')
+    persistSessionUserId('user-42')
+    expect(localStorage.getItem('active_userid')).toBe('user-42')
+  })
+
+  it('does not clear existing userId when omitted', async () => {
+    const { persistSessionUserId } = await import('./auth.js')
+    localStorage.setItem('active_userid', 'user-1')
+    persistSessionUserId(undefined)
+    expect(localStorage.getItem('active_userid')).toBe('user-1')
+  })
+})