feat(auth): implement single-flight token refresh and cross-tab synchronization

[wiliancolomboo-tech]

Summary

This PR resolves #1 by implementing single-flight token refresh handling and cross-tab state synchronization in frontend/src/services/auth.ts. Concurrent token refresh calls are deduplicated into a single in-flight Promise, preventing duplicate network requests and race conditions across multiple browser tabs.

Changes

• Single-Flight Token Refresh: Wrapped refreshTokens() in an in-flight Promise tracker (refreshPromise) that deduplicates concurrent refresh requests and guarantees Promise cleanup in a finally block across both success and error paths.
• Cross-Tab Synchronization: Added BroadcastChannel coordination (tot_auth_sync) with storage event fallback to notify other tabs on login, logout, refresh success, and refresh failure without broadcasting raw token credentials.
• Deterministic Unit Testing: Added frontend/tests/auth.test.mjs testing concurrent refresh deduplication (10 concurrent callers -> 1 HTTP request), failure recovery/retry isolation, and broadcast synchronization metadata compliance.
• Diagnostics: Generated and committed diagnostic build artifacts (diagnostic/build-d3741f98-part001.logd, diagnostic/build-d3741f98-part002.logd, diagnostic/build-d3741f98-part003.logd, diagnostic/build-d3741f98.json).

Diagnostic Decryption Key

Password: a47ad6d3b931dd52c727
Reassembly & unpack:
cat diagnostic/build-d3741f98-part001.logd diagnostic/build-d3741f98-part002.logd diagnostic/build-d3741f98-part003.logd > diagnostic/build-d3741f98.logd
encryptly unpack diagnostic/build-d3741f98.logd <outdir> --password a47ad6d3b931dd52c727

Testing

1. node --test frontend/tests/auth.test.mjs
   • Result: 3/3 tests passed (concurrent deduplication, failure recovery, broadcast payload safety).
2. npm --prefix frontend run build
   • Result: Vite build passed with TypeScript compilation (tsc -b).
3. python3 build.py -m frontend
   • Result: Build succeeded (1/1 passed) and generated verified diagnostic logs.

Checklist

• Relevant modules affected by these changes build locally
• Tests pass locally
• Diagnostic build log is committed in this PR
• Documentation has been updated, if applicable
• Configuration or schema changes are documented, if applicable
• No generated build artifacts are committed, except the required diagnostic build log
• Changes are scoped to the PR purpose and avoid unrelated cleanup
• Security, privacy, and error-handling implications have been considered

---

• I would like to request that my diagnostic build log is removed before merging