feat(api): guarded single-flight token refresh with one retry

[leo202000]

Closes #2.

Summary

Implements a guarded token refresh flow in frontend/src/services/api.ts so concurrent 401 responses share a single in-flight /auth/refresh operation and the original request is retried exactly once with refreshed credentials.

Changes

• AuthenticationError (typed, code 401) surfaced when refresh fails.
• refreshAuthTokens() single-flight guard: concurrent callers share one in-flight refresh promise; the refresh request uses a raw fetch (bypassing request()) so a 401/403 from /auth/refresh cannot recurse.
• request() detects 401, dedupes refresh, retries the original request exactly once (preserving method/headers/body via re-applied interceptors), clears auth state and throws AuthenticationError on failure. At most one refresh per request() call prevents loops.
• Auth state kept in sync across the legacy auth_token key and the tot_auth_tokens bundle so the retried request picks up the new access token.
• Public auth API (get/post/put/patch/del, Endpoints, interceptors) unchanged.

Validation

• python3 build.py ran; encrypted diagnostic bundle included:
  • diagnostic/build-eae330fb.logd (DIAG magic, 13919 bytes, >=10240)
  • diagnostic/build-eae330fb.json (metadata + decrypt password)

Tests

• frontend/src/services/tests/api.refresh.test.ts (vitest, jsdom): concurrent 401s share one refresh; successful single retry; refresh failure clears auth + throws AuthenticationError; no loop when /auth/refresh returns 401.
• Run with npm test (vitest devDependency + vitest.config.ts added; test files excluded from the tsc -b build via tsconfig exclude).