fix: persist refresh token across Telegram Mini App reopens

Telegram Mini App creates a new WebView on each open, clearing
sessionStorage. Combined with 24h auth_date validation on backend,
returning users couldn't re-authenticate after closing the app.

- Move refresh token to localStorage for persistence across sessions
- Keep access token in sessionStorage (short-lived, OK to lose)
- Fix auth store initialize() to recover when access token is missing
  but refresh token exists in localStorage
- Remove separate mountThemeParams() call to fix ConcurrentCallError
  (mountMiniApp() handles it internally in SDK v3)
- Update token migration logic for new storage strategy

src/store/auth.ts

@@ -141,12 +141,14 @@ export const useAuthStore = create<AuthState>()(
             const accessToken = tokenStorage.getAccessToken();
             const refreshToken = tokenStorage.getRefreshToken();
 
-            if (!accessToken || !refreshToken) {
+            if (!refreshToken) {
               set({ isLoading: false, isAuthenticated: false });
               return;
             }
 
-            // Проверяем валидность токена перед использованием
+            // No access token or it's expired — try refresh
+            // This handles Mini App reopens where sessionStorage was cleared
+            // but refresh token persists in localStorage
             if (!isTokenValid(accessToken)) {
               // Используем централизованный менеджер для refresh
               const newToken = await tokenRefreshManager.refreshAccessToken();