Remove some confusion between exchange and set-session endpoints, all using set-session now with a bearer code. Using codes in remote auth as well. Full separation of cookie and OIDC codes.

frontend/src/stores/auth.js

@@ -41,21 +41,21 @@ export const useAuthStore = defineStore('auth', {
         }, effectiveDuration)
       }
     },
-    async setSessionCookie(result) {
-      if (!result?.session_token) {
-        console.error('setSessionCookie called with missing session_token:', result)
-        throw new Error('Authentication response missing session_token')
+    async exchangeCode(result) {
+      if (!result?.exchange_code) {
+        console.error('exchangeCode called with missing exchange_code:', result)
+        throw new Error('Authentication response missing exchange_code')
       }
       return await apiJson('/auth/api/set-session', {
         method: 'POST',
-        headers: {'Authorization': `Bearer ${result.session_token}`},
+        headers: { 'Authorization': `Bearer ${result.exchange_code}` },
       })
     },
     async register() {
       this.isLoading = true
       try {
         const result = await register()
-        await this.setSessionCookie(result)
+        await this.exchangeCode(result)
         await this.loadUserInfo()
         this.selectView()
         return result
@@ -68,7 +68,7 @@ export const useAuthStore = defineStore('auth', {
       try {
         const result = await authenticate()
 
-        await this.setSessionCookie(result)
+        await this.exchangeCode(result)
         await this.loadUserInfo()
         this.selectView()