fix(security): keep form drafts per user and delete them on logout

Drafts were stored in localStorage by form only, so on a shared phone
the next person was offered the previous user's unfinished entry
(colony observations, treatment and supplier details). Drafts are now
keyed by the signed-in user id and every draft is removed on logout,
like the offline cache already was.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/auth/auth-context.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import { createContext, useCallback, useContext, useEffect, useState, ReactNode } from 'react';
+import { clearAllFormDrafts } from '@/lib/forms/draft-storage';
 import {
   getCurrentUserRequest,
   isMfaRequired,
@@ -91,6 +92,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     await logoutRequest();
     storeAccessToken(null);
     setUser(null);
+    // Unfinished form entries belong to the person who typed them.
+    clearAllFormDrafts();
     // The service worker cache now holds real business data (colonies,
     // tasks, etc.) for offline viewing - on a shared/handed-off device
     // that must not survive into the next person's session.
@@ -134,6 +137,11 @@ export function AuthProvider({ children }: { children: ReactNode }) {
   );
 }
 
+/** The signed-in user's id, or null - usable outside an AuthProvider (tests). */
+export function useCurrentUserId(): string | null {
+  return useContext(AuthContext)?.user?.id ?? null;
+}
+
 export function useAuth(): AuthContextValue {
   const context = useContext(AuthContext);
   if (!context) {