fix: isolate account state and ignore stale session responses

src/services/auth.js

@@ -53,8 +53,10 @@ export async function restoreSession() {
   if (!token) return null;
   try {
     const res = await fetch('/api/auth/me', { headers: { Authorization: `Bearer ${token}` } });
+    if (getToken() !== token) return getStoredUser();
     if (!res.ok) { clearSession(); return null; }
     const data = await res.json();
+    if (getToken() !== token) return getStoredUser();
     if (data.success) { setSession(token, data.user); return data.user; }
     clearSession();
     return null;

src/services/tenderState.js

@@ -16,3 +16,7 @@ export function applyTenderStates(tenders, records = {}) {
 export function tenderSnapshot(t) {
   return Object.fromEntries(['id','ikn','baslik','kurum','tarih','saat','sehir','alimTuru'].map(k => [k,t[k] ?? '']));
 }
+
+export function publicTender(tender) {
+  return Object.fromEntries(Object.entries(tender).filter(([key]) => !USER_STATE_FIELDS.includes(key)));
+}