OCD-5430: continued removal of AngularJS stuff

[andlar]

What

Removes the AngularJS authService and networkService and moves session state
into the Redux store, with axios-jwt owning token storage. 29 commits, 0 behind
staging.

• New services/auth.service.js — the single copy of hasAnyRole(user, roles)
  (previously duplicated in index.run.js and user-wrapper.jsx) and
  clearSession(dispatch, removeCookie), which tears down cookies, tokens and
  user state together. All three logout paths now go through it.
• userInfo slice reducers are pure again — the ngStorage-* migration moved
  to store.js, which now also purges the legacy jwtToken/refreshToken keys
  that no longer had an owner. setUser(user) plus a separate clearUser()
  replaces the ambiguous setUser({ user }) / setUser(undefined) pair.
• CookiesProvider moved above ApiWrapper and UserWrapper so session
  cookies are set and cleared through one set of options.
• One Redux store shared across entry bundles, held on window.chplStore.
• Download and upload links refresh an expired access token via
  useFreshAccessToken() (refreshTokenIfNeeded) instead of getAccessToken(),
  which only read storage. All nine call sites now report and bail rather than
  sending Bearer undefined.
• Housekeeping picked up along the way: yarn 4.17.1 → 4.18.0 (yarn.lock
  unchanged, so inert), a new CLAUDE.md, and removal of the unused
  MINUTES_UNTIL_IDLE/MINUTES_UNTIL_LOGOUT build globals. The yarn release file
  is ~1,950 lines of the diff.

Please look closely at

store.js — the store on window. index.html injects all 11 webpack entry
chunks and each compiled its own copy of store.js, so a page held ten independent
stores. UserWrapper used to hide this by re-reading localStorage on mount and
listening for $rootScope loggedIn/loggedOut; removing authService took that
away, leaving a login visible only to the bundle that rendered the form. Cold start
still worked because every store preloads from chplState, so the breakage only
appeared on a login or logout after page load — and a refresh hid it.

Verified by loading the real module under three independent registries: 1 instance,
a dispatch through one visible in the others, a subscriber in a third notified. With
the global cleared (pre-fix): 3 instances, user: undefined in the second,
subscriber never fired.

Cookie clearing. user-wrapper.jsx previously sat above CookiesProvider, so
its useCookies fell back to react-cookie's default context instance, which has no
defaultSetOptions. removeCookie('refresh_token') therefore serialized without
domain/path and never deleted the .healthit.gov; path=/ cookie — it only worked
because authService.logout() also issued an explicit document.cookie expiry.
defaultSetOptions is unchanged; only the provider's position moved.

Security review

Focused review of the diff: no HIGH or MEDIUM findings introduced. One candidate
was raised and rejected — the migration now purges the legacy token keys, but the
underlying exposure (refresh token readable from localStorage by same-origin JS) is
pre-existing and by design in axios-jwt, plus the refresh_token cookie is not
httpOnly.

For awareness rather than action here: these download URLs carry the token as an
authorization=Bearer%20… query parameter, which predates this branch. Because the
token is now guaranteed valid where it was often expired, the value of that
pre-existing surface (history, address bar, proxy logs) goes up. A short-lived
download token or POST/blob download is the real fix.

Follow-ups (not in this PR)

• browserInfo.slice.js has the same impure-reducer pattern, with comments reading
  "temporary until redux store is truly global" — a premise this PR resolves.
• ng-idle stays for now: it provides the Title service the chpl run block
  injects. Replacing that with a React/TitleProvider equivalent would let the
  dependency go.

🤖 Generated with Claude Code