The login JWT and the per-seat rejoin token shared the localStorage key
'shelem_token', so joining a game overwrote the auth token with the random
seat token. The socket then reconnected as an unauthenticated guest, so every
seat was recorded with userId=null and no stats or history were attributed.
- Seat token now uses its own key 'shelem_seat_token'; 'shelem_token' is auth-only
- Add GET /api/me + boot-time validateAuth() to drop stale/corrupted tokens
instead of running as a "logged in" ghost
- reauthSocket() re-authenticates the live socket on login/register
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
goyban
3c26eb4ba5