refactor: migrate frontend auth to cookie refresh contract

[Priveetee]

Summary

• migrate frontend auth parsing and session hydration to the new backend contract that returns accessToken, and refresh sessions through cookie-based /auth/refresh without sending legacy body tokens.
• ensure authenticated API calls can recover from missing in-memory tokens by attempting refresh first, then fail signed-out if refresh is not possible.
• route sign-out and recommendation tracking through the refreshed auth path so logout clears server refresh cookie state and tracker calls remain authenticated after reloads.

Included Commits

• 13e7b75 fix: route logout and tracker calls through refreshed auth
• 1d4a6c6 refactor: align auth session flow with cookie refresh contract

Validation

• bun run check
• bun run sherif
• bun run knip
• bun run build
• local runtime smoke: register -> refresh(cookie) -> me -> logout -> refresh 401