fix(auth): restore cross-tab permissions and bind retries to session identity

src/modules/auth/views/AuthViews.test.mjs

@@ -117,7 +117,8 @@ test('uses real auth endpoints and single-flight refresh handling', () => {
   assert.match(httpSource, /window\.location\.replace\(`\/login\?redirect=\$\{encodeURIComponent\(redirect\)\}`\)/)
   assert.match(authStoreSource, /decodeMerchantToken/)
   assert.match(authStoreSource, /MerchantTokenExpiredError && getRefreshToken\(\)/)
-  assert.match(authStoreSource, /applyToken\(await refreshAuthenticatedSession\(\)\)/)
+  assert.match(authStoreSource, /const refreshedToken = await refreshAuthenticatedSession\(\)/)
+  assert.match(authStoreSource, /applyToken\(refreshedToken\)/)
   assert.doesNotMatch(authStoreSource, /mock-client:/)
 })
 
@@ -152,7 +153,7 @@ test('shows a forced re-login notice after login identifiers change', () => {
 test('keeps a valid local session during temporary context and refresh outages', () => {
   assert.match(authStoreSource, /function isExpiredSessionError/)
   assert.match(authStoreSource, /if \(isExpiredSessionError\(error\)\)/)
-  assert.match(authStoreSource, /sessionRestored\.value = true\s+return/)
+  assert.match(authStoreSource, /if \(!isCurrent\(\)\) return\s+sessionRestored\.value = false/)
   assert.match(httpSource, /if \(mappedError\.status === 401 \|\| mappedError\.code === 'A0401'\)/)
   assert.doesNotMatch(httpSource, /catch \(refreshError\) \{\s+clearSessionTokens\(\)/)
 })