fix(auth): unify token refresh through Node runtime to stop replay-attack kills
Middleware (Edge runtime) and client hooks (Node runtime) each refreshed the access token independently, sharing no in-memory mutex across the runtime boundary. After a long idle period both paths could fire with the same refresh_token at once — Java flags the second use as replay and invalidates the whole session, kicking the user to login.
Middleware now calls our own /api/auth/refresh route instead of hitting Java directly, and HttpAuthSessionRepository.refreshSession() dedupes concurrent calls for the same refresh_token so only one Java request goes out no matter which caller triggered it.
Also includes two small unrelated fixes: invoice row navigation now uses router.push instead of a Link so the whole row is clickable, and useAdminTransactions treats accountId as optional in the query string.