fix(auth): add single-flight token refresh handling and cross-tab sync (fixes #1)

[wiliancolomboo-tech]

Summary

Fixes #1

This PR resolves the token refresh concurrency race condition in the authentication service (frontend/src/services/auth.ts). When multiple browser tabs or concurrent API callers attempt to refresh tokens simultaneously, requests are now coalesced into a single in-flight Promise<AuthTokens | null>. In addition, authentication state updates (LOGIN, LOGOUT, REFRESH_SUCCESS, REFRESH_FAILURE) are synchronized across open tabs using BroadcastChannel with a window.storage event listener fallback, without exposing sensitive raw tokens.

Changes

• Single-Flight Coalescing: Added module-level inFlightRefresh promise tracker in frontend/src/services/auth.ts to ensure concurrent callers share the exact same active refresh operation and receive identical resolved session tokens.
• In-flight Cleanup: Guaranteed inFlightRefresh is reset in a finally block on both success and failure, ensuring subsequent token renewals can execute cleanly.
• Cross-Tab Synchronization: Integrated BroadcastChannel('tot_auth_channel') and window.addEventListener('storage') to notify other browser contexts of auth state transitions (REFRESH_SUCCESS, REFRESH_FAILURE, LOGIN, LOGOUT) without transmitting raw JWT tokens over message payloads.
• Error Recovery: Synchronized full token clearance and listener notifications upon failed refresh attempts.
• Documentation: Updated auth.ts module documentation detailing concurrency guarantees and cross-tab behavior.
• Diagnostic Build Log: Executed python3 build.py and committed diagnostic artifacts in diagnostic/.

Testing

• Verified TypeScript typechecking and bundle build cleanly locally (npm run build / tsc -b && vite build passed 100%).
• Ran python3 build.py to generate and commit diagnostic log chunks (diagnostic/build-d6e2059c*.logd and diagnostic/build-d6e2059c.json).
• Validated single-flight coalescing and promise cleanup behavior.

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging