include argus workflow

LockInBro/AuthManager.swift

@@ -22,6 +22,7 @@ final class AuthManager {
         do {
             let response = try await APIClient.shared.login(email: email, password: password)
             TokenStore.shared.token = response.accessToken
+            TokenStore.shared.refreshToken = response.refreshToken
             currentUser = response.user
             isLoggedIn = true
         } catch {
@@ -40,6 +41,7 @@ final class AuthManager {
                 displayName: displayName
             )
             TokenStore.shared.token = response.accessToken
+            TokenStore.shared.refreshToken = response.refreshToken
             currentUser = response.user
             isLoggedIn = true
         } catch {
@@ -58,6 +60,7 @@ final class AuthManager {
                 fullName: fullName
             )
             TokenStore.shared.token = response.accessToken
+            TokenStore.shared.refreshToken = response.refreshToken
             currentUser = response.user
             isLoggedIn = true
         } catch {
@@ -67,8 +70,20 @@ final class AuthManager {
     }
 
     func logout() {
-        TokenStore.shared.token = nil
+        SessionManager.shared.stopMonitoring()
+        TokenStore.shared.clear()
         currentUser = nil
         isLoggedIn = false
+        errorMessage = nil
+    }
+
+    /// Called by APIClient when the server returns 401 and the refresh token is also dead.
+    func handleSessionExpired() {
+        guard isLoggedIn else { return }
+        SessionManager.shared.stopMonitoring()
+        TokenStore.shared.clear()
+        currentUser = nil
+        isLoggedIn = false
+        errorMessage = "Your session expired — please log in again."
     }
 }