fix: Add SSR guards to tokenStorage setters and clear method

[Copilot]

The tokenStorage object had inconsistent SSR safety—getters checked typeof window !== 'undefined' but setters and clear() called localStorage unconditionally, causing errors in server-side contexts.

Changes

Added window guards to all mutation methods:

• setToken(), setRefreshToken(), setSessionKey() now no-op when window is undefined
• clear() now no-ops when window is undefined

// Before
setToken: (token) => localStorage.setItem(TOKEN_KEY, token),

// After
setToken: (token) => {
  if (typeof window !== 'undefined') {
    localStorage.setItem(TOKEN_KEY, token);
  }
},

All tokenStorage methods now handle SSR contexts safely.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• registry.npmmirror.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/_temp/ghcca-node/node/bin/npm install (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)