fix(auth): add single-flight token refresh handling and cross-tab sync ($35 Bounty)

[qkikasq]

Closes #1

Problem

Concurrent token refresh requests could overlap and cause stale token writes and inconsistent session states.

Solution

• Added single-flight refresh coordination via SingleFlightAuthManager.
• Coalesces in-flight refresh calls so all concurrent requests await the same promise.
• Propagates success and failure across tabs using safe BroadcastChannel messaging without logging sensitive raw tokens.
• Fully clears in-flight marker on failure so subsequent retries proceed normally.
• Added comprehensive deterministic validation tests.

[qkikasq]

Bounty Payout Details

• Developer / GitHub: @qkikasq
• Preferred Payout Rails:
  • USDT (TRC-20) / TON: Available via Telegram @wallet (TG: @rqfiw)
  • Revolut / SEPA EUR: Available upon merge confirmation.

PR is fully validated and ready for review.