fix(bot): single-flight token re-exchange + keep tokens on transient failure

[dzhhem]

What

Harden the bot's auth retry path in apiClient.ts:

• Single-flight re-exchange — concurrent 401s for the same user now share one /auth/telegram/exchange call instead of firing one each.
• Keep tokens on transient exchange failure — a failed re-exchange (rate limit, cold start, network) now fails just that one request and keeps the stored tokens, instead of wiping them.
• Log API failures — non-ok responses and re-exchange failures are logged with status + path. The bot previously had zero visibility into API errors.

Why

A burst of commands hitting an expired token fired N concurrent exchanges, which trips the API's exchange rate limit (10 / 15 min) and 401s the whole burst. Wiping tokens on a transient blip then forced a full re-auth cascade, turning one failed request into an outage. And with no logging, a production flap was undiagnosable from the bot side — the added warn is exactly what surfaced the real status code (a 500 from a Supabase pooler / Prisma prepared-statement issue, fixed separately via DATABASE_URL config).

Testing

Manual: local bot against the deployed API, spammed /history / /summary — re-exchange dedup holds and the new log surfaced the underlying error. No automated bot test infra yet (only history.format is covered).