[AZ-510] Auth bootstrap: POST refresh + chained /users/me

Replace the broken `GET /api/admin/auth/refresh` (no `credentials:'include'`)
mount-time bootstrap with `POST /api/admin/auth/refresh` (with credentials)
chained to `GET /api/admin/users/me`. Returning users with a valid HttpOnly
refresh cookie no longer flash through `/login`. Closes Finding B3 / Vision P3.

- Add module-scoped `bootstrapInflight` guard (StrictMode double-mount safety)
  + test-only reset hook exported via the `src/auth` barrel; `tests/setup.ts`
  resets it in `afterEach` to prevent pending-promise leakage between tests.
- Defensive `hasPermission` against legacy `/users/me` payloads omitting
  `permissions`; default MSW handler now seeds `permissions` explicitly.
- Add `endpoints.admin.usersMe()` builder (STC-ARCH-02 forbids the literal).
- Bulk-swap 15 test files from `http.get` -> `http.post` for the refresh
  override so intentional bootstrap-fail tests still fail correctly.
- Update auth component description; mark B3 closed.
- Code review verdict PASS; static + fast suites green (231 / 13 skipped).

Batch report: _docs/03_implementation/batch_13_cycle3_report.md

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/msw/handlers/admin.ts

@@ -1,6 +1,6 @@
 import { http } from 'msw'
 import { jsonResponse, noContent, paginate } from '../helpers'
-import { seedUsers, opAlice } from '../../fixtures/seed_users'
+import { seedUsers, opAlice, seedPermissions } from '../../fixtures/seed_users'
 import { seedClasses } from '../../fixtures/seed_classes'
 
 // Default `/api/admin/*` handlers — auth round-trip, users, classes-write,
@@ -28,7 +28,13 @@ export const adminHandlers = [
 
   http.post('/api/admin/auth/logout', () => noContent()),
 
-  http.get('/api/admin/users/me', () => jsonResponse(opAlice)),
+  // AZ-510 chains GET /users/me after POST refresh during AuthProvider
+  // bootstrap. The default user shape includes `permissions` so production
+  // code paths (e.g., hasPermission, RBAC route gates) get a realistic
+  // payload without each test having to override.
+  http.get('/api/admin/users/me', () =>
+    jsonResponse({ ...opAlice, permissions: seedPermissions[opAlice.id] ?? [] }),
+  ),
 
   http.get('/api/admin/users', () => jsonResponse(paginate(seedUsers))),