refactor: introduce AuthClient abstraction (Phase 1 of #64)

[xiaomi7732]

Summary

Phase 1 of #64 — refactor MSAL auth behind an AuthClient interface so future providers (e.g. Google Identity Services for the Sheets backend) can plug in without touching consumers.

Strict refactor. Zero behavior change. Microsoft remains the only provider. This is the matching auth-side companion to the storage abstraction in #63.

Architecture

lib/
  auth/
    types.ts                          # AuthClient interface, AuthProvider, AuthUser
    useAuthClient.ts                  # Hook returning the active client
    microsoft/
      MicrosoftAuthClient.ts          # Wraps MSAL

Interface

export interface AuthClient {
  readonly provider: AuthProvider;     // 'microsoft' today
  readonly isAuthenticated: boolean;
  readonly busy: boolean;
  acquireToken(options?: { silentOnly?: boolean }): Promise<string>;
  login(): Promise<void>;
  logout(): Promise<void>;
  getUser(): AuthUser | null;
}

Implementation notes

• acquireToken reads accounts fresh from instance.getAllAccounts() rather than from useMsal-captured state. This eliminates the post-loginPopup race that PR refactor: introduce storage abstraction layer behind TodoStore #63 worked around with a one-shot store. The hack is gone — app/page.tsx now calls store.listBooks() directly after auth.login().

• acquireToken({ silentOnly: true }) for background checks. Replaces the instance.acquireTokenSilent direct call in app/page.tsx's availability check. Never opens a popup from a useEffect.

• getUser() sources displayName/email from MSAL account info instead of calling /me on Graph. Books page no longer makes a round-trip just to render the welcome banner.

Removed

• lib/hooks/useGraphToken.ts — logic absorbed into MicrosoftAuthClient.
• getUserInfo + UserInfo from graphService.ts — no longer used.

Changed consumers

All pages and hooks that previously imported useGraphToken now use useAuthClient:

• app/page.tsx (uses silentOnly for background check)
• app/books/page.tsx (uses auth.getUser() and auth.logout())
• app/matrix/page.tsx, app/scrum/page.tsx, app/cancelled/page.tsx
• lib/hooks/useBookId.ts, lib/store/useStore.ts
• components/HamburgerMenu.tsx (uses auth.logout() instead of instance.logoutPopup)

Build + lint

• npm run build ✅
• npm run lint shows no new errors/warnings (pre-existing ones unchanged)

Out of scope

• No new providers, no Google Identity Services integration — that's Phase 2.
• No UI changes.
• No new dependencies.

Smoke test checklist (manual)

• Sign in with existing Microsoft account — works as before
• Existing ?bookId=... URLs still resolve
• CRUD operations on Matrix / Scrum / Cancelled pages
• Session sweep still runs
• Sign out — landing page returns to unauthenticated state
• Sign back in — same account loads books

[Copilot]

Pull request overview

Introduces an AuthClient abstraction around the existing MSAL authentication flow as Phase 1 of #64, keeping Microsoft as the only provider while preparing consumers for future auth providers.

Changes:

• Adds AuthClient types and a Microsoft MSAL-backed implementation.
• Replaces useGraphToken usage across pages, hooks, store creation, and menu logout.
• Removes direct Graph /me user info access and deleted the old token hook.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/arrange-v4/lib/auth/types.ts	Defines the new auth abstraction contract.
src/arrange-v4/lib/auth/useAuthClient.ts	Exposes the active auth client hook.
src/arrange-v4/lib/auth/microsoft/MicrosoftAuthClient.ts	Implements AuthClient using MSAL.
src/arrange-v4/lib/hooks/useGraphToken.ts	Removes the old MSAL token hook.
src/arrange-v4/lib/store/useStore.ts	Injects token acquisition through AuthClient.
src/arrange-v4/lib/hooks/useBookId.ts	Uses auth abstraction for authentication state.
src/arrange-v4/lib/graphService.ts	Removes user-info Graph helper.
src/arrange-v4/components/HamburgerMenu.tsx	Routes sign-out through AuthClient.
src/arrange-v4/app/page.tsx	Uses AuthClient for login and silent availability checks.
src/arrange-v4/app/books/page.tsx	Uses AuthClient for login/logout and user display.
src/arrange-v4/app/matrix/page.tsx	Uses AuthClient in matrix page auth flow.
src/arrange-v4/app/scrum/page.tsx	Uses AuthClient in scrum page auth flow.
src/arrange-v4/app/cancelled/page.tsx	Uses AuthClient in cancelled page auth flow.

[Copilot]

Pull request overview

Copilot reviewed 13 out of 13 changed files in this pull request and generated no new comments.

[xiaomi7732]

PR Review Loop Summary

• 2 review rounds completed
• 1 issue raised — fixed:
  • Round 1: getUser() captured useMsal's accounts at hook render time, reintroducing the same stale-state race acquireToken() avoids. Fixed to read instance.getAllAccounts() fresh.
  • Round 2: Clean — zero unresolved comments ✅
• Final status: All review threads resolved