fix: clear stale auth flags and improve user name fallback logic (#637)

- Clear AuthTokenStore in _silentSessionRecovery when session is invalid (Case 2)

- Use .trim().isNotEmpty for userName fallback to handle empty strings (Case 1)

userfront/lib/main.dart

@@ -104,11 +104,13 @@ Future<void> _silentSessionRecovery() async {
       _log.info("[SessionRecovery] Recovery complete. Subject: $subject");
     } else {
       _log.warning("[SessionRecovery] Session found but subject is empty.");
+      AuthTokenStore.clear();
     }
   } catch (e) {
     _log.info(
       "[SessionRecovery] No valid cookie session found or request failed: $e",
     );
+    AuthTokenStore.clear();
   }
 }