Token refresh fails — Authentik revokes rotated refresh tokens causing full-page redirect

## Bug When the OIDC access token expires (~5 minutes), the token refresh mechanism fails. Instead of silently renewing the session, the user gets a full-page redirect to the Authentik login flow, interrupting whatever they were doing. ## Root cause Authentik rotates refresh tokens on each use. The flow: 1. Access token expires after ~5 min 2. `jwtCallback` calls `refreshAccessToken(refreshToken)` via the OIDC token endpoint 3. Authentik returns `400 Bad Request` with `invalid_grant`: "The provided authorization grant or refresh token is invalid, expired, revoked" 4. `token.error = REFRESH_TOKEN_ERROR` is set on the JWT 5. `SessionErrorHandler` in `SessionProvider.tsx` detects the error and calls `signIn("authentik")` — a full-page redirect The refresh token is being revoked by Authentik because of refresh token rotation. After the first successful refresh, the old refresh token is invalidated, but subsequent JWT callbacks may still hold the old token. ## Evidence Server logs show repeated failures: ``` [tokenRefresh] Refresh failed: 400 Bad Request {"error": "invalid_grant", "error_description": "The provided authorization grant or refresh token is invalid, expired, revoked..."} ``` ## Impact - Users lose their work-in-progress (form data, unsaved changes) every ~5 minutes when the redirect fires - E2E test suite cannot run all specs together — tests that run after the first ~5 minutes fail due to mid-test OAuth redirects - The existing `token-refresh.spec.ts` E2E test may not catch this because it tests a single refresh cycle, not the rotation scenario ## Possible fixes 1. Ensure the `jwtCallback` stores the new refresh token atomically so subsequent calls always use the latest one 2. Check if Authentik has a setting to disable refresh token rotation for the Gathrings OAuth application 3. Consider using a longer-lived refresh token or adjusting the access token lifetime