fix(auth): revoke captured client sessions safely on logout

src/api/session.ts

@@ -27,7 +27,16 @@ export function accessTokenIdentity(token: string): string | null {
     if (!encoded) return null
     const normalized = encoded.replace(/-/g, '+').replace(/_/g, '/')
     const bytes = Uint8Array.from(atob(normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=')), character => character.charCodeAt(0))
-    const value = JSON.parse(new TextDecoder().decode(bytes))
+    const json = new TextDecoder().decode(bytes)
+    // Match whole JSON strings first so digits inside arbitrary string values
+    // are never rewritten. Preserve integer identity claims before JSON.parse
+    // can round them; number/string representations then share one identity.
+    const exactIdentityJson = json.replace(/"(?:\\.|[^"\\])*"|-?\d+(?:\.\d+)?(?:[eE][+-]?\d+)?/g, (part, offset: number) => {
+      if (!/^-?\d+$/.test(part)) return part
+      const key = json.slice(0, offset).match(/"(user_id|tenant_id|membership_id|operator_tenant_id)"\s*:\s*$/)
+      return key ? JSON.stringify(part) : part
+    })
+    const value = JSON.parse(exactIdentityJson)
     if (!value?.user_id || !value.tenant_id || !value.membership_id || value.app_code !== 'MERCHANT') return null
     return JSON.stringify([value.user_id, value.tenant_id, value.membership_id, value.operator_tenant_id, value.app_code, value.client_type].map(item => item == null ? null : String(item)))
   } catch {