feat(oauth): persist session token for automatic re-auth on restart

- Save user_auth_token after successful OAuth login
- On bootstrap, restore session via saved token if no email/password creds
- If token is expired, clear it so user sees login screen normally
- Clear OAuth token on v2_clear_saved_credentials (logout)
- Add login_with_token() to api client (reuses OAuth /user/login step)

Also rename t->translateStore in NowPlayingBar.svelte (ADR-001 fix from Codex)
and improve clean-dev-runtime.sh to kill all stale processes and ports

scripts/clean-dev-runtime.sh

@@ -4,9 +4,25 @@ set -euo pipefail
 # Kill stale dev processes that commonly leave Vite/Svelte CSS pipeline in a bad state.
 pkill -f '[n]ode .*vite dev' || true
 pkill -f '[n]ode .*tauri dev' || true
+pkill -f '[c]argo run' || true
+pkill -f '[t]arget/debug/qbz' || true
 pkill -f '[t]arget/debug/qbz-nix' || true
 
-# Clean generated frontend caches.
-rm -rf .svelte-kit .vite node_modules/.vite
+# Force-free dev ports in case a process survives pattern-based kill.
+for port in 1420 1421; do
+  pids="$(lsof -ti :"${port}" 2>/dev/null || true)"
+  if [[ -n "${pids}" ]]; then
+    kill ${pids} 2>/dev/null || true
+    sleep 0.2
+    # Escalate only if still alive after TERM.
+    still_alive="$(lsof -ti :"${port}" 2>/dev/null || true)"
+    if [[ -n "${still_alive}" ]]; then
+      kill -9 ${still_alive} 2>/dev/null || true
+    fi
+  fi
+done
 
-echo "[qbz] Dev runtime cleaned (.svelte-kit/.vite + stale vite/tauri/qbz processes)."
+# Clean generated frontend caches.
+rm -rf .svelte-kit .vite node_modules/.vite build dist .cache
+
+echo "[qbz] Dev runtime cleaned (processes + ports 1420/1421 + cache directories)."