[$45 BOUNTY] feat: add guarded API token refresh handling

[shadow6427]

Summary

Resolves issue #2 (Bounty $45)

Add guarded token refresh handling to the API layer (frontend/src/services/api.ts).

Changes

• Introduced a single-flight refresh guard (handleTokenRefresh) ensuring concurrent 401s share a single refresh call.
• The original request is retried exactly once with the new token.
• If the refresh fails, localStorage is cleared, and an ApiError with code 401 is thrown, skipping further retries.
• Wrote an executable test fixture in frontend/src/services/api_test_fixture.ts that mocks fetch to cover successful/failed single/concurrent retries.

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally (fixture output manually verified)
• Diagnostic build log is committed in this PR (metadata JSON since .logd failed on mac ARM64)
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered