feat(admin-web): proactively refresh access tokens before expiry

Track access token expires_at, dedupe concurrent refreshes, retry SSE on
401, and refresh on window focus/visibility so long-lived sessions stop
hitting the login redirect mid-task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/lib/errors.ts

@@ -4,6 +4,7 @@ const errorMessageMap: Record<string, string> = {
   invalid_credentials: "邮箱或密码错误",
   no_tenant: "当前账号未关联租户",
   not_authenticated: "请先登录",
+  missing_bearer_token: "请先登录",
   invalid_access_token: "登录状态已失效",
   invalid_refresh_token: "刷新令牌已失效",
   refresh_session_expired: "登录已过期，请重新登录",