feat(mobile): identité user-first — login/password, SecureStore, scoping par compte

- api: DeviceRegistration device-only, login/changePassword/resolveUser, interception 401 (purge) exonérée sur le login ; type User aligné sur le fil (is_admin)
- SecureStore (expo-secure-store v57) : token + profil, jamais en SQLite ; miroir active_user_id
- AuthContext : statut loading/signedOut/signedIn, bootstrap register→restore, signIn/signOut, garde-fou switch de compte
- app/login.tsx + gate de routes dans _layout (Redirect signedOut) ; i18n fr/en
- DB v5 : user_id sur pending_operations + resource_permissions (UNIQUE par user), repos scopés (user_id IS ? OR IS NULL)
- syncOutbox : delta permissions par compte (Map), outbox poussée du compte actif uniquement
- tests: register/login/401/resolve/changePassword, scoping outbox+permissions, migrations v5 ; e2e live revert register→login admin

mobile/context/AuthContext.tsx

@@ -1,20 +1,33 @@
 import { createContext, useContext, useEffect, useMemo, useState } from 'react';
 import type { ReactNode } from 'react';
 import { useSyncDevice } from '../features/syncDevice';
-import { api, setAuthToken } from '../api/client';
+import { api, setAuthToken, setUnauthorizedHandler } from '../api/client';
 import {
-  getDeviceAuthToken,
+  clearActiveUserId,
   getDeviceUserId,
-  saveDeviceAuthToken,
+  setActiveUserId,
 } from '../services/localStorage';
-import type { AuthContextValue, User } from './AuthContext.types';
+import {
+  clearStoredSession,
+  getStoredAccount,
+  getStoredToken,
+  setStoredSession,
+} from '../services/secureStore';
+import type { AuthContextValue, AuthStatus, User } from './AuthContext.types';
 
 const AuthContext = createContext<AuthContextValue | null>(null);
 
 export function AuthProvider({ children }: { children: ReactNode }) {
-
   const [user, setUser] = useState<User | null>(null);
   const [deviceUserId, setDeviceUserId] = useState<string | null>(null);
+  const [status, setStatus] = useState<AuthStatus>('loading');
+
+  const signOut = async () => {
+    await Promise.allSettled([clearStoredSession(), clearActiveUserId()]);
+    setAuthToken(null);
+    setUser(null);
+    setStatus('signedOut');
+  };
 
   useEffect(() => {
     let active = true;
@@ -24,16 +37,26 @@ export function AuthProvider({ children }: { children: ReactNode }) {
       if (active) setDeviceUserId(id);
 
       try {
-        let token = await getDeviceAuthToken();
-        if ( !token ) {
-          const { data } = await api.registerDevice(id);
-          token = data.token;
-          await saveDeviceAuthToken(token);
-        }
-        setAuthToken(token);
+        // Enregistrement du device (idempotent côté serveur) — obligatoire
+        // avant le login (INVALID_DEVICE_ID sinon). Aucun token émis ici.
+        await api.registerDevice(id);
       } catch (error) {
         console.warn('device registration failed (offline?)', error);
       }
+
+      try {
+        const [token, storedUser] = await Promise.all([getStoredToken(), getStoredAccount()]);
+        if (active && token && storedUser) {
+          setAuthToken(token);
+          setActiveUserId(storedUser.id);
+          setUser(storedUser);
+          setStatus('signedIn');
+          return;
+        }
+      } catch (error) {
+        console.warn('could not restore session', error);
+      }
+      if (active) setStatus('signedOut');
     };
 
     bootstrap();
@@ -44,7 +67,30 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     };
   }, []);
 
-  const value = useMemo(() => ({ user, deviceUserId }), [user, deviceUserId]);
+  // 401 sur un endpoint protégé (token expiré/révoqué, compte supprimé) →
+  // purge de la session. Le 401 du login est exonéré côté client (option
+  // skipUnauthorizedHandling dans api/client.ts).
+  useEffect(() => {
+    setUnauthorizedHandler(() => {
+      void signOut();
+    });
+    return () => setUnauthorizedHandler(null);
+  }, [signOut]);
+
+  const signIn = async (username: string, password: string) => {
+    const id = deviceUserId ?? (await getDeviceUserId());
+    const result = await api.login(username, password, id);
+    await setStoredSession(result.data.token, result.data.user);
+    await setActiveUserId(result.data.user.id);
+    setAuthToken(result.data.token);
+    setUser(result.data.user);
+    setStatus('signedIn');
+  };
+
+  const value = useMemo(
+    () => ({ user, deviceUserId, status, signIn, signOut }),
+    [user, deviceUserId, status, signIn, signOut],
+  );
 
   return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;
 }

mobile/context/AuthContext.types.ts

@@ -1,6 +1,13 @@
-export type User = {};
+import type { User } from '../api/types';
+
+export type { User };
+
+export type AuthStatus = 'loading' | 'signedOut' | 'signedIn';
 
 export type AuthContextValue = {
   user: User | null;
   deviceUserId: string | null;
+  status: AuthStatus;
+  signIn: (username: string, password: string) => Promise<void>;
+  signOut: () => Promise<void>;
 };