feat(auth): skip backend refresh when access_token is still fresh
Middleware may already have rotated the refresh token on a concurrent navigation. If access_token has >60s left, return 200 without hitting the Java refresh endpoint to avoid "Token reuse likely" session kills.
Tests: mock next/headers cookies; add fresh-token skip path test.