fix: fully clear DA session on sign-out and enrich unauthorized errors

[davidnuescheler]

Problem

After connecting, users hit Error invoking remote method 'da:list': Error: Unauthorized: invalid or expired token — even after #9, and especially users who had signed in before.

#9 cleared the .da-token.json file, but the app keeps credentials in four more places that all survived sign-out and 401 recovery:

• per-site preview tokens in .site-tokens.json (+ its in-memory cache)
• the content.da.live bearer-token cache
• IMS session cookies in the persistent persist:aem-preview-login partition (deliberately persistent so refreshes complete silently) and the persist:aem-preview webview partition

So a previously signed-in user's IMS session kept silently re-minting credentials for the old account.

Changes

• Complete session invalidation (src/main/da-session.js): invalidateDaSession removes the token file, empties .site-tokens.json, resets token/preview caches, and clears IMS/DA cookies + web storage across the default, preview, and preview-login sessions. Runs on explicit sign-out and automatically on any 401.
• Richer unauthorized errors: every 401 in ContentApiClient now throws an HttpRequestError carrying method, URL, status, x-error header, and body detail — still prefixed with Unauthorized: invalid or expired token so existing detection keeps matching. The main process appends the site (org/repo + backend) and IMS JWT diagnostics (client_id, user, issued/expires — never the token value) and logs the same line to the persisted log under the da-auth scope.
• No more silent browser logins: withContentClient resolves the stored token instead of getValidToken, so a background request with an expired token fails fast with the diagnostic error instead of popping a browser (also removes a port-9898 race under concurrent requests). The renderer shows "AEM sign-in expired or was rejected — sign in again" with the detail in the tooltip/console.

If a user still hits a 401 after a truly fresh sign-in, the error now shows whether the token is stale (old issued timestamp ⇒ cached somewhere) or fresh-but-rejected (⇒ da.live permissions for that org).

Testing

• 10 new tests in test/da-session.test.js (token resolution errors, JWT diagnostics, storage clearing across partitions, full invalidation)
• enriched-401 test in test/content-api-client.test.js
• npm run lint and npm test green (201 tests); dev app boots clean

🤖 Generated with Claude Code

[trieloff]

🎉 This PR is included in version 1.6.2 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀