Your JWT storage is a security hole

localStorage is accessible to any JavaScript on the page — one XSS vulnerability exposes all tokens. Use httpOnly cookies instead: they can't be read by JavaScript. Add SameSite=Strict and Secure flags. Never store sensitive tokens in localStorage.