Authenticate board users

Board users authenticate with a short-lived bearer access token and a single-use refresh token. The SDK persists returned token pairs through its configured async storage and leaves navigation to the app.

1. Choose the storage boundary

auth.storage accepts 'memory', 'local', 'session', 'nostore', or a CustomStorage with async getItem, setItem, and removeItem methods.

• Browsers default to 'memory'; choose 'local' for persistence across tabs and reloads or 'session' for tab-scoped persistence.
• Servers default to 'nostore'. Keep tokens in the app's httpOnly cookie and follow cavuno-board-server-sessions for every SSR session and refresh rule.
• A custom store is appropriate when the app already owns a user-scoped persistence boundary.

'local' and 'session' are browser runtimes; constructing them off-browser fails immediately.

Complete when: the selected store matches the runtime and a shared server client remains nostore.

2. Establish the session