[auth] Update login page, add token refresh, and fix password reset flow

[amahuli03]

Related Issue

Closes #486
Part of #483
Blocked by #484 and #485

Description

Updates the login page, header, and session management for non-admin users now that registration and activation are working.

• the login page previously had an admin-only warning banner and no way for users to navigate to registration or password reset. That banner is removed and links to register and reset password are added

• the password reset request and confirmation states previously redirected silently to home with no confirmation. Both now show confirmation page with appropriate message for password reset request confirmation and for password reset confirmation

• Header: unauthenticated users now see a "Log In" button in the header. Previously there was no way to reach the login page from the navigation. The change is on both web and mobile navs.
• Token refresh: Sessions previously expired silently after 60 minutes with no recovery. A response interceptor is added to adminApi that catches 401 responses, attempts a silent token refresh using the refresh token, and retries the original request. If the refresh token is expired or missing, tokens are cleared and the user is redirected to login. A queue handles concurrent requests that fail simultaneously during a refresh, preventing multiple refresh attempts.

Manual Tests

Manually tested that everything is working:

• Login page no longer show admin-only messaging, now shows working links to create account and reset password
• Password reset request shows confirmation state instead of redirecting
• Password reset confirm shows success state instead of redirecting
• Verified password reset works as intended. The work here was also done in the /resetPassword route
• Unauthenticated users see "Log In" in header on desktop and mobile
• Token refresh verified by shortening access token lifetime to 30 seconds. Expired token triggers silent refresh and original request retries successfully

Reviewers

@sahilds1 @taichan03

Notes

EMAIL_HOST_USER and EMAIL_HOST_PASSWORD must be set to valid Gmail SMTP credentials. Without these, activation and password reset emails will not send in production.