[Frontend] Store authentication tokens outside JavaScript-readable localStorage

## Problem

Persisting bearer tokens in localStorage expands the impact of any XSS vulnerability.

## Relevant code

`src/contexts/AuthContext.tsx`

## Proposed scope

Adopt secure HttpOnly cookie sessions with CSRF protection or document and implement an equivalent hardened design.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start with src/contexts/AuthContext.tsx and reproduce or characterize the localStorage token behavior with a focused automated test. Trace the existing authentication flow and related tests before deciding how the proposed cookie-session or equivalent hardened design fits; done means tokens are not JavaScript-readable, CSRF protection is covered, regression cases pass, and relevant documentation is updated.

Written by the indexing model from the issue text.