fix(auth): clear stale session before login/signup to stop refresh token loop

When users land on /login or /sign-up with expired auth cookies, the
Supabase client singleton starts an auto-refresh loop with the stale
token (400 → 429 endlessly). The middleware fix clears cookies for the
next page load, but can't stop a JS loop already running in the browser.

Fix: call signOut({ scope: 'local' }) before signInWithPassword,
signUp, and signInWithOAuth to clear cached stale tokens from the
Supabase client's memory and cookies before attempting authentication.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: guillermoscript

components/login-form.tsx

@@ -45,6 +45,12 @@ export function LoginForm({ className, tenantId, ...props }: LoginFormProps) {
     setError(null)
 
     try {
+      // Clear any stale session before login. When a user lands on /login with
+      // expired cookies, the Supabase client's auto-refresh ticker may already be
+      // retrying with the old refresh token. Signing out locally clears the cached
+      // tokens and stops the loop, giving signInWithPassword a clean slate.
+      await supabase.auth.signOut({ scope: 'local' })
+
       const { error } = await supabase.auth.signInWithPassword({
         email,
         password,
@@ -87,6 +93,7 @@ export function LoginForm({ className, tenantId, ...props }: LoginFormProps) {
     setError(null)
 
     try {
+      await supabase.auth.signOut({ scope: 'local' })
       const { error } = await supabase.auth.signInWithOAuth({
         provider: 'google',
         options: {

components/sign-up-form.tsx

@@ -53,6 +53,7 @@ export function SignUpForm({ className, tenantId, ...props }: SignUpFormProps) {
     }
 
     try {
+      await supabase.auth.signOut({ scope: 'local' })
       const { error } = await supabase.auth.signUp({
         email,
         password,
@@ -78,6 +79,7 @@ export function SignUpForm({ className, tenantId, ...props }: SignUpFormProps) {
     setError(null)
 
     try {
+      await supabase.auth.signOut({ scope: 'local' })
       const { error } = await supabase.auth.signInWithOAuth({
         provider: 'google',
         options: {