fix(auth): accept epoch-changing token refreshes

[wunianze666-netizen]

Summary

• bypass the routine one-minute token refresh throttle only when a replacement token belongs to the same user and carries a different revocation epoch
• apply the same epoch-aware decision before and inside the cross-tab media-auth lock, preserving the existing race checks
• cover the throttle boundaries and the full dynamicBaseQuery -> media-cookie sync -> Redux dispatch path

Related Issues / Discussions

Closes #9541

QA Instructions

• pnpm exec vitest run (170 files, 2,227 tests)
• pnpm run lint:tsc
• pnpm run lint:dpdm
• pnpm exec eslint --max-warnings=0 src/features/auth/store/authTokenRefresh.ts src/features/auth/store/authTokenRefresh.test.ts src/services/api/index.ts src/services/api/endpoints/auth.test.ts
• pnpm exec prettier --check src/features/auth/store/authTokenRefresh.ts src/features/auth/store/authTokenRefresh.test.ts src/services/api/index.ts src/services/api/endpoints/auth.test.ts

The integration regression marks a routine refresh as recently accepted, returns a same-user token with an incremented token_epoch, and verifies that the media cookie is synchronized before tokenRefreshed is dispatched. Unit coverage keeps same-epoch, cross-user, and unreadable replacements throttled.

Merge Plan

No special merge handling is required.

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Tests added / updated
• No Redux slice state change; migration is not applicable
• Documentation is not applicable to this behavioral bug fix
• Updated What's New copy (not a release PR)

[wunianze666-netizen]

Synced this branch with current main (ef832d1aa) in merge commit 6cb39486d. The PR diff remains limited to the same four auth refresh files. I re-ran the focused validation against the updated dependency lock: 15/15 Vitest tests passed with no type errors, ESLint passed with zero warnings, and Prettier check passed. No code changes beyond the upstream sync were needed.

[wunianze666-netizen]

Added an end-to-end negative regression in 00a27c396 for the other half of the epoch-refresh contract: while an epoch-changing replacement must bypass the one-minute throttle, a routine same-user/same-epoch replacement must still make only the original API request, skip the media-cookie write, and avoid dispatching a redundant token update.

Validation: 25/25 focused auth/API tests passed with no TypeScript errors; targeted ESLint, Prettier, and git diff --check passed. The production implementation is unchanged; this commit strengthens the boundary against accidentally disabling routine refresh throttling while fixing password-change recovery.

[wunianze666-netizen]

Added a backward-compatibility regression for sessions carrying JWTs minted before the token_epoch claim existed (commit 5cad312). The end-to-end refresh test now covers both explicit epoch 0 and an omitted epoch claim, and verifies that an epoch 1 replacement is accepted inside the normal one-minute throttle, synchronizes the media cookie, and dispatches tokenRefreshed. Validation: 6 auth test files / 40 tests passed with no type errors; targeted ESLint and Prettier checks passed; git diff --check passed.

[wunianze666-netizen]

The new openapi-checks and typegen-checks failures are runner-timeout cancellations during dependency installation, before either schema/type generation step ran. Both jobs resolved the environment and then spent the full ~14-minute install window downloading the uncached CUDA/PyTorch stack (including 528.9 MiB torch, 527.5 MiB cuDNN, 403.5 MiB cuBLAS, and other NVIDIA wheels); GitHub cancelled them while uv was still downloading. The auth-relevant frontend-checks and frontend-tests passed, as did both Windows matrices and the remaining Python checks. I attempted to rerun the two cancelled workflows, but fork authors do not have the required repository admin permission. A maintainer rerun of only those two checks should be sufficient; no production or generated-file change is indicated by these logs.