fix(auth): stop refresh-token replay killing the session, and the login spinner it left behind
Refresh dedupe was keyed by in-flight duration: the entry was evicted 5s after the Java call settled. Rotation only writes the new cookie onto the response of the request that triggered it, so every request that left the browser earlier still carries the old token — an RSC navigation, a client hook's 401 handler, another open tab. After a tab idles past token expiry those arrive in a burst spread over seconds, and the stragglers landed outside the 5s window and replayed the token against Java, which treats a second use as an attack and kills the whole session family.
Keep each refresh_token mapped to its rotated result for 60s instead. Late callers are answered from the cache and still relay the rotated cookies, so their stale copy gets repaired. Failed refreshes are evicted immediately — they rotated nothing, so a genuine retry must get through.