feat: implement cross-tab idle session timeout and add request collapsing to token refresh logic.

libs/auth/src/lib/components/AuthBootstrap.tsx

@@ -54,9 +54,13 @@ export function AuthBootstrap({ children }: { children: ReactNode }) {
             response = await fetch(`${BASE_API_URL}/auth/me`, {
               headers: { Authorization: `Bearer ${fresh}` },
             });
-          } catch {
-            // No refresh token, or the server rejected it — fall through to
-            // the logout below.
+          } catch (err) {
+            // Only the server rejecting the refresh token ends the session —
+            // same rule as the API layer's 401 handler. A 502 or a network
+            // blip during refresh keeps the stored session; the screens
+            // surface their own errors.
+            if (!(err as { sessionExpired?: boolean })?.sessionExpired) return;
+            // Rejected — fall through to the logout below.
           }
         }