fix: persist refresh token across Telegram Mini App reopens

Telegram Mini App creates a new WebView on each open, clearing
sessionStorage. Combined with 24h auth_date validation on backend,
returning users couldn't re-authenticate after closing the app.

- Move refresh token to localStorage for persistence across sessions
- Keep access token in sessionStorage (short-lived, OK to lose)
- Fix auth store initialize() to recover when access token is missing
  but refresh token exists in localStorage
- Remove separate mountThemeParams() call to fix ConcurrentCallError
  (mountMiniApp() handles it internally in SDK v3)
- Update token migration logic for new storage strategy

src/main.tsx

@@ -7,7 +7,6 @@ import {
   retrieveRawInitData,
   mountMiniApp,
   miniAppReady,
-  mountThemeParams,
   mountViewport,
   expandViewport,
   mountSwipeBehavior,
@@ -43,16 +42,17 @@ if (!alreadyInitialized) {
     clearStaleSessionIfNeeded(retrieveRawInitData() || null);
 
     // Mount components — each in its own try/catch so one failure doesn't block others
+    // Note: mountMiniApp() internally mounts themeParams in SDK v3,
+    // so we don't call mountThemeParams() separately to avoid ConcurrentCallError
     try {
       mountMiniApp();
     } catch {
       /* already mounted */
     }
     try {
-      mountThemeParams();
       bindThemeParamsCssVars();
     } catch {
-      /* already mounted */
+      /* theme params not yet available */
     }
     try {
       mountSwipeBehavior();