fix: resolve telegram auth token expiration and clean up codebase

- Fix stale initData comparison in clearStaleSessionIfNeeded that destroyed
  valid refresh tokens on mobile WebView reopens
- Restrict X-Telegram-Init-Data header to auth endpoints only
- Close Mini App on auth retry to force fresh initData from Telegram
- Merge Connection page error/not-configured states for better UX
- Remove unnecessary comments across 40+ files (section dividers,
  restating comments, noise catch block comments)
- Configure ESLint allowEmptyCatch to properly handle intentional
  empty catch blocks (62 warnings resolved)

src/pages/AdminPolicies.tsx

@@ -6,8 +6,6 @@ import { rbacApi, AccessPolicy, AdminRole } from '@/api/rbac';
 import { PermissionGate } from '@/components/auth/PermissionGate';
 import { usePlatform } from '@/platform/hooks/usePlatform';
 
-// === Icons ===
-
 const BackIcon = () => (
   <svg
     className="h-5 w-5 text-dark-400"
@@ -96,8 +94,6 @@ const CalendarIcon = () => (
   </svg>
 );
 
-// === Helpers ===
-
 interface PolicyConditions {
   time_range?: { start: string; end: string };
   ip_whitelist?: string[];
@@ -130,8 +126,6 @@ function parseConditions(raw: Record<string, unknown>): PolicyConditions {
   return result;
 }
 
-// === Sub-components ===
-
 interface EffectBadgeProps {
   effect: 'allow' | 'deny';
   className?: string;
@@ -154,8 +148,6 @@ function EffectBadge({ effect, className }: EffectBadgeProps) {
   );
 }
 
-// === Main Page ===
-
 export default function AdminPolicies() {
   const { t } = useTranslation();
   const navigate = useNavigate();