refactor(auth): Migrate session storage to flutter_secure_storage

README.md

@@ -18,7 +18,8 @@ The launcher is responsible for:
 - `flutter_bloc` for launcher UI state
 - `get_it` and `injectable` for dependency injection
 - `dio` for Web API and file download requests
-- `shared_preferences` for launcher preferences
+- `flutter_secure_storage` for launcher sessions
+- `shared_preferences` for non-sensitive launcher preferences
 
 ## Prerequisites
 
@@ -93,7 +94,7 @@ See `docs/launcher_web_api_spec.md` for the API and sync contract.
 ## Documentation
 
 - `AGENTS.md`: architecture, commands, and repository rules for contributors
-- `TODO.md`: refactoring, verification, and Flutter upgrade tasks
+- `TODO.md`: remaining verification and maintenance tasks
 - `docs/linting.md`: format, analyze, test, and Lefthook workflow
 - `docs/project_review.md`: project review with strengths, weaknesses, and
   upgrade feasibility notes