fix(auth): route session lifecycle through Square

tests/unit/auth-routes.test.ts

@@ -734,9 +734,10 @@ describe('auth host api routes', () => {
     );
 
     expect(refreshResponse.statusCode).toBe(200);
-    const [, refreshInit] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(String(refreshInit.body)).toBe(
-      'grant_type=refresh_token&refresh_token=main-refresh-r1',
+    const [refreshUrl, refreshInit] = fetchMock.mock.calls[0] as [string, RequestInit];
+    expect(refreshUrl).toBe('https://square.nianxx.cn/api/auth/refresh');
+    expect(refreshInit.body).toBe(
+      JSON.stringify({ refresh_token: 'main-refresh-r1' }),
     );
     expect(String(refreshInit.body)).not.toContain('renderer-refresh-r0');
   });
@@ -904,8 +905,9 @@ describe('auth host api routes', () => {
 
     expect(response.statusCode).toBe(200);
     expect(fetchMock).toHaveBeenCalledWith(
-      'https://biz.nianxx.cn/auth/token/logout',
+      'https://square.nianxx.cn/api/auth/logout',
       expect.objectContaining({
+        method: 'POST',
         headers: { Authorization: 'Bearer main-current-access-token' },
       }),
     );
@@ -1034,8 +1036,8 @@ describe('auth host api routes', () => {
     );
 
     expect(fetchMock).toHaveBeenCalledWith(
-      'https://biz.nianxx.cn/auth/token/logout',
-      expect.objectContaining({ method: 'DELETE' }),
+      'https://square.nianxx.cn/api/auth/logout',
+      expect.objectContaining({ method: 'POST' }),
     );
     expect(response.statusCode).toBe(500);
   });