Fix produk hilang: auth session expired state + non-overwriting products load

lib/state/app_state.dart

@@ -109,6 +109,12 @@ class AppState extends ChangeNotifier {
   String? userId;
   String? userRole;
   UserProfile? _profile;
+
+  /// True jika session auth mati total (refresh token pun kedaluwarsa).
+  /// UI (kasir) memakai ini untuk menampilkan info "sesi habis" +
+  /// tombol login ulang, bukan list kosong yang membingungkan.
+  bool _sessionExpired = false;
+  bool get sessionExpired => _sessionExpired;
   final Map<String, String> _profileNames = {};
 
   double _discount = 0;
@@ -474,11 +480,15 @@ class AppState extends ChangeNotifier {
     _supabase.auth.onAuthStateChange.listen((event) {
       if (event.session != null) {
         userId = event.session!.user.id;
+        _sessionExpired = false;
         _loadProfile();
       } else {
+        // Sesi mati total (logout / refresh token ikut kedaluwarsa):
+        // tandai agar UI bisa menampilkan pesan "sesi habis", bukan diam.
         userId = null;
         userRole = null;
         _profile = null;
+        _sessionExpired = true;
       }
       notifyListeners();
     });
@@ -511,8 +521,14 @@ class AppState extends ChangeNotifier {
         _supabase.from('products').select().eq('store_id', _currentStoreId).order('name'),
         'Load products',
       );
-      products = rows.map((e) => Product.fromJson(e)).toList();
-      if (products.isEmpty) _seed();
+      final loaded = rows.map((e) => Product.fromJson(e)).toList();
+      // Hasil kosong dari server JANGAN menimpa data lama — itu tanda
+      // query gagal diam-diam (misal JWT expired), bukan toko kehabisan produk.
+      if (loaded.isNotEmpty) {
+        products = loaded;
+      } else if (products.isEmpty) {
+        _seed();
+      }
     } catch (e) {
       // Jangan crash refresh: produk lama tetap ditampilkan, error tercatat di log.
       debugPrint('Gagal load products: $e');