fix(pwa): weiße Seite nach Android-Neustart ohne Master-Key vermeiden

Erzwingt Login wenn nur die HTTP-Session übrig ist, begrenzt SW-Reloads,
fängt Bootstrap-/Render-Fehler ab und stabilisiert den PWA-Kaltstart.

Co-authored-by: Cursor <cursoragent@cursor.com>

client/src/services/auth.ts

@@ -33,13 +33,28 @@ export function setActiveMasterKey(key: ArrayBuffer | null) {
 }
 
 export async function checkServerSession(): Promise<{ authenticated: boolean; userId?: string }> {
+  const controller = new AbortController()
+  const timeoutId = window.setTimeout(() => controller.abort(), 8_000)
   try {
-    return await apiJson<{ authenticated: boolean; userId?: string }>(`${API_BASE}/session`)
+    return await apiJson<{ authenticated: boolean; userId?: string }>(`${API_BASE}/session`, {
+      signal: controller.signal
+    })
   } catch {
     return { authenticated: false }
+  } finally {
+    window.clearTimeout(timeoutId)
   }
 }
 
+/** Master key is memory-only; after process kill the HTTP session may outlive local crypto state. */
+export function hasUnlockedLocalSession(): boolean {
+  return !!(
+    getActiveMasterKey() &&
+    localStorage.getItem('active_username') &&
+    localStorage.getItem('active_userid')
+  )
+}
+
 export async function reauthWithPasskey(): Promise<boolean> {
   const options = await apiJson<any>(`${API_BASE}/reauth-options`, {
     method: 'POST'