fix: improve session management and UI highlights

lib/auth/context.tsx

@@ -174,6 +174,8 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
   useSessionSync({
     onLogout: () => {
       localStorage.removeItem('user')
+      localStorage.removeItem('ciphera_token_refreshed_at')
+      localStorage.removeItem('ciphera_last_activity')
       window.location.href = '/'
     },
     onLogin: (userData) => {

lib/utils/formatDate.ts

@@ -0,0 +1,30 @@
+export function formatRelativeTime(dateStr: string): string {
+  const date = new Date(dateStr)
+  const now = new Date()
+  const diffMs = now.getTime() - date.getTime()
+  const diffMin = Math.floor(diffMs / 60000)
+  const diffHr = Math.floor(diffMin / 60)
+  const diffDay = Math.floor(diffHr / 24)
+
+  if (diffMin < 1) return 'Just now'
+  if (diffMin < 60) return `${diffMin}m ago`
+  if (diffHr < 24) return `${diffHr}h ago`
+  if (diffDay < 7) return `${diffDay}d ago`
+
+  return date.toLocaleDateString('en-US', {
+    month: 'short',
+    day: 'numeric',
+    year: date.getFullYear() !== now.getFullYear() ? 'numeric' : undefined,
+  })
+}
+
+export function formatFullDate(dateStr: string): string {
+  return new Date(dateStr).toLocaleString('en-US', {
+    weekday: 'short',
+    month: 'short',
+    day: 'numeric',
+    year: 'numeric',
+    hour: 'numeric',
+    minute: '2-digit',
+  })
+}

lib/utils/requestId.ts

@@ -1,6 +1,11 @@
 /**
  * Request ID utilities for tracing API calls across services
  * Request IDs help debug issues by correlating logs across frontend and backends
+ *
+ * IMPORTANT: This module stores mutable state (lastRequestId) at module scope.
+ * This is safe because apiRequest (the only caller) runs exclusively in the
+ * browser where JS is single-threaded. If this ever needs server-side use,
+ * replace the module variable with AsyncLocalStorage.
  */
 
 const REQUEST_ID_HEADER = 'X-Request-ID'
@@ -23,7 +28,8 @@ export function getRequestIdHeader(): string {
 }
 
 /**
- * Store the last request ID for error reporting
+ * Store the last request ID for error reporting.
+ * Browser-only — single-threaded, no concurrency risk.
  */
 let lastRequestId: string | null = null