Implement Token Refresh Instead of Deleting the Token on 401

[maugauwi-hash]

Labels: enhancement, ios, security
Priority: High
Estimated Time: 2 hours

Description:
AuthToken.expiresAt (Models.swift:38-41) is decoded but never read anywhere in the iOS app.
APIClient.execute() (APIClient.swift:189-193) reacts to a 401 by deleting the stored token and
forcing a full re-authentication, even though a proactive refresh before expiry would avoid
interrupting the user mid-task (e.g., mid check-in).

Tasks:

• Add a POST /auth/refresh-style call to APIClient (coordinate with the shared contract, see Document the WebSocket Message Schema #129-area docs)
• Schedule a refresh timer against AuthToken.expiresAt in AuthStore
• Fall back to the current delete-and-reauth behavior only when refresh itself fails
• Add tests for "token near expiry" and "refresh fails" paths

---

[maztah1]

@maztah1 has applied to work on this issue as part of the Stellar Wave Program's 7th wave.

Can i solve this issue please, thank you

ℹ️ Repo Maintainers: To accept this application, review their application or assign @maztah1 to this issue.

[drips-wave]

Congratulations, @maztah1! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on July 30, 2026.

🧑‍💻 @maztah1: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊