Task: Route Makelore auth lifecycle through Works Square

Identity

Route Works Square access-token refresh through POST /api/auth/refresh instead of calling the one-feel OAuth endpoint from Electron Main.
Route remote logout through POST /api/auth/logout on Works Square while preserving Main-owned session cleanup behavior.
Update focused session and auth-route regression tests, including rotated refresh-token persistence.

Login, refresh, and logout must share the Works Square authentication boundary.
Do not embed the deployed custom OAuth client secret in Makelore.
Preserve Main ownership of tokens, the seven-day inactivity policy, refresh single-flight behavior, fail-closed persistence semantics, and local runtime cleanup.
Do not change unrelated browser/OAuth-provider integrations.

Electron Main now refreshes managed Works Square sessions with POST https://square.nianxx.cn/api/auth/refresh and a JSON refresh-token payload. It no longer sends an OAuth Basic credential or calls the one-feel token endpoint directly.
Main-owned logout now calls POST https://square.nianxx.cn/api/auth/logout with the current Main access token, while retaining the existing local session, secure persistence, event-session, provider-key, and runtime cleanup behavior.
Removed the now-unused Electron auth configuration module that embedded the legacy app client secret and password encryption key.
Preserved refresh-token rotation, single-flight behavior, terminal 400/401 clearing, transient-error retention, and persistence-before-return semantics.

Red phase: focused tests failed in five expected places because refresh and logout still targeted biz.nianxx.cn with the legacy method/credential contract.
pnpm exec vitest run tests/unit/works-square-session.test.ts tests/unit/auth-routes.test.ts: 56 passed.
Focused session/auth compatibility suite: 86 passed across five test files.
Full pnpm exec vitest run: 184 test files and 2190 tests passed.
pnpm run typecheck: passed.
pnpm run lint:check: passed with 0 errors and 7 pre-existing React warnings in unrelated files.
pnpm run build:vite: passed for Renderer, Electron Main, preload, and utility worker.
Full pnpm run build stopped before compilation because the required Learning Player artifact/source was not supplied; the subsequent direct Vite production build passed.
git diff --check: passed. Source scan found no direct one-feel refresh/logout URL, Basic auth header, embedded client secret, or deleted auth-config import under electron/.

Deploy the Works Square refresh/logout endpoints before distributing a Makelore build containing this client change.
Supply the separately managed Learning Player artifact when producing the final packaged installer.

Target canonical document: .project-docs/20-architecture/data-flow.md and the authentication decision index. Proposal: record Works Square as the required boundary for the complete desktop authentication lifecycle (login, refresh, and logout), with confidential OAuth clients owned only by Works Square. Evidence: focused request-contract tests, full 2190-test client suite, typecheck, lint, and production Vite build. Future impact: new desktop authentication operations must be added to Square rather than embedding service credentials or direct one-feel calls in Makelore. Semantic conflicts: none; this completes the proxy work explicitly deferred by the integrated native-login task. Human confirmation required: no; the user explicitly selected the unified Square boundary.