A valid access token, refreshing first if it expires within the margin (or force).
Loads a stored session (e.g. at app start). Returns null when signed out.
Single-flight refresh: concurrent callers share one request.
After login/register: keep the session and its first access token.
Changes fields of the stored session, e.g. the email after it changed (SPEC §16).
Forget the session locally (after logout, or when the server rejected the refresh token).