fix(auth): accept epoch-changing token refreshes

[wunianze666-netizen]

Summary

• bypass the routine one-minute token refresh throttle only when a replacement token belongs to the same user and carries a different revocation epoch
• apply the same epoch-aware decision before and inside the cross-tab media-auth lock, preserving the existing race checks
• cover the throttle boundaries and the full dynamicBaseQuery -> media-cookie sync -> Redux dispatch path

Related Issues / Discussions

Closes #9541

QA Instructions

• pnpm exec vitest run (170 files, 2,227 tests)
• pnpm run lint:tsc
• pnpm run lint:dpdm
• pnpm exec eslint --max-warnings=0 src/features/auth/store/authTokenRefresh.ts src/features/auth/store/authTokenRefresh.test.ts src/services/api/index.ts src/services/api/endpoints/auth.test.ts
• pnpm exec prettier --check src/features/auth/store/authTokenRefresh.ts src/features/auth/store/authTokenRefresh.test.ts src/services/api/index.ts src/services/api/endpoints/auth.test.ts

The integration regression marks a routine refresh as recently accepted, returns a same-user token with an incremented token_epoch, and verifies that the media cookie is synchronized before tokenRefreshed is dispatched. Unit coverage keeps same-epoch, cross-user, and unreadable replacements throttled.

Merge Plan

No special merge handling is required.

Checklist

• The PR has a short but descriptive title, suitable for a changelog
• Tests added / updated
• No Redux slice state change; migration is not applicable
• Documentation is not applicable to this behavioral bug fix
• Updated What's New copy (not a release PR)