fix(demo): persist login across window close (localStorage) + add Sign out
The token was kept in sessionStorage, which the browser clears when the
tab/window closes — forcing re-login every time. Use localStorage so sign-in
persists across closes and restarts. Add a "Sign out" control in the header so
the persisted token can be cleared on demand (a stale/expired token still
falls back to the sign-in screen via the existing /me check).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>