feat(web): avoid persisting access tokens and PII in localStorage

[nullscribe]

User Story / Goal

As a user, I want my session information to be stored securely so that my personal information is not at risk.

Acceptance Criteria

• Access tokens (JWTs) are not stored in localStorage.
• User's email or other personally identifiable information (PII) is not stored in localStorage.
• Session management is handled through HttpOnly secure cookies or by keeping tokens in memory.
• The application remains functional for authenticated users.

Technical Breakdown (Optional)

The current implementation stores JWTs and user information in localStorage, which is vulnerable to XSS attacks.

Designs / Mockups (Optional)

No response