feat(web): add authenticated file workflow

- feat: connect login and logout to the REST API with session-scoped tokens, protected routing, single-flight refresh, and authenticated query cache cleanup.
- feat: add the Ant Design application shell with root file listing, pagination, small-file upload, and authenticated download.
- test: cover session storage and API retry and error behavior with Vitest.
- docs: document the browser milestone, same-origin API topology, and deferred transfer and account features.

docs/web/decisions.md

@@ -17,3 +17,29 @@
 - The Web and future native clients consume the same client-neutral API contracts.
 - MyGO or a reverse proxy may host `web/dist` with an SPA fallback without changing the rendering model.
 - MyGO domain components own file-browser behavior and must not depend on Ant Design request behavior for business logic.
+
+## 2026-07-14: Browser Authentication and Root File Workflow
+
+**Context**: The first Web milestone needs to exercise the existing login, file
+list, upload, and download APIs without committing to the later directory,
+account, admin, or large-transfer designs.
+
+**Decisions**:
+
+| Area | Choice | Guidance |
+|------|--------|----------|
+| API topology | Same-origin `/api/v1` | Vite proxies `/api` to the local Go server. Production uses a same-origin reverse proxy; the milestone does not add CORS or Go static hosting. |
+| Browser session | Token pair in `sessionStorage` | Reloading the tab preserves the session, while closing the tab clears it. Do not add persistent login until the token transport design is revisited. |
+| Token refresh | Refresh once after a protected request returns 401 | Share one in-flight refresh across concurrent failures, store the rotated pair, and retry each request once. Clear the session if refresh or the retry fails. |
+| File scope | Root directory only | List root entries, upload one file to root, and download files. Show directories as non-interactive rows. |
+| Transfer model | Browser `FormData` upload and authenticated Blob download | This is intentionally limited to the small-file milestone; progress, streaming-to-disk, chunking, resume, and queues remain deferred. |
+
+**Consequences**:
+- The API client owns bearer headers, error parsing, refresh coordination, and
+  session invalidation; pages consume operation-specific functions.
+- TanStack Query caches are cleared whenever an authenticated session ends so
+  one user cannot see another user's cached file metadata.
+- The file picker is independent of Ant Design upload request behavior, keeping
+  transfer policy in MyGO code.
+- Handwritten TypeScript wire types remain temporary until an OpenAPI contract
+  is available.