Keep web account sessions in memory only

SovereignAI-Starter/flutter_app/lib/core/auth/session_token_store.dart

@@ -1,3 +1,4 @@
+import 'package:flutter/foundation.dart';
 import 'package:flutter_secure_storage/flutter_secure_storage.dart';
 
 abstract interface class SessionTokenStore {
@@ -25,3 +26,21 @@ class SecureSessionTokenStore implements SessionTokenStore {
   @override
   Future<void> delete() => _storage.delete(key: _key);
 }
+
+/// Keeps browser sessions in memory only; a reload or tab close signs out.
+class EphemeralSessionTokenStore implements SessionTokenStore {
+  String? _token;
+
+  @override
+  Future<String?> read() async => _token;
+
+  @override
+  Future<void> write(String token) async => _token = token;
+
+  @override
+  Future<void> delete() async => _token = null;
+}
+
+SessionTokenStore createDefaultSessionTokenStore() => kIsWeb
+    ? EphemeralSessionTokenStore()
+    : SecureSessionTokenStore();

SovereignAI-Starter/flutter_app/lib/core/network/api_repository.dart

@@ -1,6 +1,6 @@
 import 'dart:convert';
-import 'dart:typed_data';
 
+import 'package:flutter/foundation.dart';
 import 'package:http/http.dart' as http;
 import 'package:http_parser/http_parser.dart';
 import 'package:file_selector/file_selector.dart';
@@ -91,10 +91,12 @@ class AgentToolStep {
 class ApiRepository {
   ApiRepository({required String baseUrl, SessionTokenStore? sessionTokenStore})
     : _baseUrl = baseUrl,
-      _sessionTokenStore = sessionTokenStore ?? SecureSessionTokenStore();
+      _sessionTokenStore =
+          sessionTokenStore ?? createDefaultSessionTokenStore();
 
   String _baseUrl;
   final SessionTokenStore _sessionTokenStore;
+  bool get accountSessionPersists => !kIsWeb;
   String? _accessToken;
   Future<String>? _loadingLocalSession;
   Future<void>? _restoringSession;