v0.2.8-rc.4

Fix

auth: attempt token refresh on page load in AuthProvider mode

When the page is refreshed after the access token expires (e.g. user leaves the page idle for a long time), the component called provider.isLoggedIn() which returned false synchronously, and immediately showed the login page without ever calling provider.refreshToken().

Root cause: setAuthProvider() treated isLoggedIn() === false as a final state, never attempting async refresh.

Fix: When isLoggedIn() returns false, setAuthProvider() now calls provider.refreshToken() asynchronously. If refresh succeeds → user stays logged in; if it fails → login page is shown.

Includes a guard to skip state updates if the auth provider was cleared (logout/destroy) during the async refresh.