feat(auth): token refresh retry on 401 responses

[trungvose]

Summary

• Added tryRefreshToken() public method to AuthStore that refreshes the Spotify access token, persists new tokens to localStorage and store state, and returns the new access token
• Rewrote UnauthorizedInterceptor to silently refresh expired tokens on 401 responses (up to 2 attempts) and replay the original failed request with the fresh token
• Token expired modal now only appears after both refresh attempts fail — previously it showed immediately on any 401

Flow

Request → API → 401 response
  │
  ├─ Is a refresh already in progress?
  │    ├─ YES → wait for it to complete, get new token, replay request
  │    └─ NO  → attempt 1:
  │              │
  │              ├─ authStore.tryRefreshToken() succeeds
  │              │    → replay original request with new Bearer token
  │              │
  │              └─ fails → attempt 2:
  │                   ├─ succeeds → replay original request
  │                   └─ fails → uiStore.showUnauthorizedModal()
  │                        → return error

Test plan

• 5 unit tests for AuthStore.tryRefreshToken() (success, localStorage persistence, state update, missing token error, API error propagation)
• 8 unit tests for UnauthorizedInterceptor (passthrough, non-401 errors, skip URLs, refresh+replay, 2 failures then modal, second attempt success, concurrent 401 coalescing, concurrent failure propagation)
• Build succeeds with no compile errors
• Manual: clear access_token from localStorage while app is running → verify silent refresh
• Manual: clear both access_token and refresh_token → verify modal appears

🤖 Generated with Claude Code