fix: resolve critical security and UI session mismatch by clearing React Query cache on login/logout and invalidating on subscription updates

frontend/src/app/checkout/success/page.tsx

@@ -2,6 +2,7 @@
 
 import { useEffect, useState } from 'react';
 import { useSearchParams, useRouter } from 'next/navigation';
+import { useQueryClient } from '@tanstack/react-query';
 import { API_BASE } from '@/lib/config';
 import { CheckCircle2, XCircle, RefreshCw } from 'lucide-react';
 
@@ -15,6 +16,7 @@ export default function CheckoutSuccessPage() {
   const searchParams = useSearchParams();
   const router = useRouter();
   const sessionId = searchParams.get('session_id');
+  const queryClient = useQueryClient();
 
   const [status, setStatus] = useState<'syncing' | 'ok' | 'error'>('syncing');
   const [message, setMessage] = useState('');
@@ -42,6 +44,7 @@ export default function CheckoutSuccessPage() {
         if (res.ok) {
           setStatus('ok');
           setMessage(data.data?.plan ? `Forfait ${data.data.plan} activé !` : 'Abonnement activé !');
+          queryClient.invalidateQueries({ queryKey: ['user', 'me'] });
           // Redirect after 2s
           setTimeout(() => router.replace('/dashboard/profile?tab=subscription'), 2000);
         } else {