feat(web): add authenticated file workflow

- feat: connect login and logout to the REST API with session-scoped tokens, protected routing, single-flight refresh, and authenticated query cache cleanup.
- feat: add the Ant Design application shell with root file listing, pagination, small-file upload, and authenticated download.
- test: cover session storage and API retry and error behavior with Vitest.
- docs: document the browser milestone, same-origin API topology, and deferred transfer and account features.

docs/web/decisions.md

@@ -17,3 +17,29 @@
 - The Web and future native clients consume the same client-neutral API contracts.
 - MyGO or a reverse proxy may host `web/dist` with an SPA fallback without changing the rendering model.
 - MyGO domain components own file-browser behavior and must not depend on Ant Design request behavior for business logic.
+
+## 2026-07-14: Browser Authentication and Root File Workflow
+
+**Context**: The first Web milestone needs to exercise the existing login, file
+list, upload, and download APIs without committing to the later directory,
+account, admin, or large-transfer designs.
+
+**Decisions**:
+
+| Area | Choice | Guidance |
+|------|--------|----------|
+| API topology | Same-origin `/api/v1` | Vite proxies `/api` to the local Go server. Production uses a same-origin reverse proxy; the milestone does not add CORS or Go static hosting. |
+| Browser session | Token pair in `sessionStorage` | Reloading the tab preserves the session, while closing the tab clears it. Do not add persistent login until the token transport design is revisited. |
+| Token refresh | Refresh once after a protected request returns 401 | Share one in-flight refresh across concurrent failures, store the rotated pair, and retry each request once. Clear the session if refresh or the retry fails. |
+| File scope | Root directory only | List root entries, upload one file to root, and download files. Show directories as non-interactive rows. |
+| Transfer model | Browser `FormData` upload and authenticated Blob download | This is intentionally limited to the small-file milestone; progress, streaming-to-disk, chunking, resume, and queues remain deferred. |
+
+**Consequences**:
+- The API client owns bearer headers, error parsing, refresh coordination, and
+  session invalidation; pages consume operation-specific functions.
+- TanStack Query caches are cleared whenever an authenticated session ends so
+  one user cannot see another user's cached file metadata.
+- The file picker is independent of Ant Design upload request behavior, keeping
+  transfer policy in MyGO code.
+- Handwritten TypeScript wire types remain temporary until an OpenAPI contract
+  is available.

docs/web/roadmap.md

@@ -8,9 +8,23 @@
 - Production may serve `web/dist` from MyGO or a reverse proxy.
 - Shared API contracts should remain client-neutral and eventually be described by OpenAPI.
 
+## Current Milestone
+
+The browser client now provides the first authenticated file workflow:
+
+- Email/password login through the shared REST API
+- Session-scoped access and refresh tokens with one automatic refresh retry
+- Protected application shell and root file list
+- Single-file upload to the root directory and authenticated download
+- Server-side pagination with 50 items per page
+
+Directory navigation and management, multi-file queues, transfer progress,
+resumable or chunked transfers, account/profile/settings screens, and admin
+screens remain deferred.
+
 ## Foundation
 
-The initial project contains only the framework and styling foundation:
+The project foundation contains:
 
 - Node.js 24 and npm
 - Vite
@@ -19,7 +33,9 @@ The initial project contains only the framework and styling foundation:
 - TanStack Query provider
 - Tailwind CSS 4 through its Vite plugin
 - Ant Design provider and components
+- Ant Design icons for application and file actions
 - Oxlint from the Vite template
+- Vitest for framework-independent client and session tests
 
 Ant Design owns reusable UI components and theme tokens. Tailwind CSS is initially limited to application layout, spacing, and responsive utilities.
 
@@ -40,10 +56,8 @@ web/src/
 
 Some dependencies are suggested for future implementation. Refer these only when the corresponding feature is implemented and propose better choices if any:
 
-- `@ant-design/icons`: Add Ant Design-consistent application and action icons when real screens require them.
 - `openapi-typescript`: Generate TypeScript API types from the shared OpenAPI document.
 - `openapi-fetch`: Provide a small type-safe Fetch client based on generated OpenAPI types.
 - `openapi-react-query`: Connect generated OpenAPI operations to TanStack Query if handwritten query adapters become repetitive.
 - `zustand`: Manage a cross-route upload queue, bulk selection, or other complex client-only state if React state is insufficient.
-- `vitest`: Run unit and integration tests using the Vite toolchain.
 - `pdfjs-dist`: Preview PDF files in the browser when document preview is implemented.