feat(cabinet): recoverable "service unavailable" screen when the backend is unreachable

When the backend was down the cabinet got stuck on a blank loader: the bootstrap
token refresh used bare axios with no timeout (hung forever), and every
interceptor guard required an HTTP response — so a transport-level failure had
zero handling and no error UI ever appeared.

Add a full-screen ServiceUnavailableScreen (extends the existing blocking-store
pattern) shown whenever the backend is unreachable, that auto-recovers when it
returns:
- New 'backend_unavailable' blocking type + BlockingOverlay branch; mirrors
  MaintenanceScreen, CloudWarningIcon, i18n in ru/en/zh/fa.
- api/health.ts: pingBackend() probes the root /health/unified (bypasses the
  /api baseURL + interceptor); URL derived from the origin for remote/sub-path
  deploys; 502/503/504 count as down. reportPossibleBackendDown() confirms an
  outage with a liveness probe before flipping, so a one-off blip never blanks a
  loaded app.
- Detected from the response interceptor (no-response) and the bootstrap refresh
  path; doRefresh gets a timeout so it can no longer hang.
- A transport failure during refresh now PRESERVES the session (distinguished
  from a rejected token via lastFailureWasTransport) instead of logging the user
  out, so recovery actually resumes.
- Recovery lifts the overlay + refetches for an already-loaded session, and only
  hard-reloads when the initial bootstrap never reached the backend — no lost
  form state. Manual retry + 5s auto-poll. Dev proxy for /health.

src/store/auth.ts

@@ -217,6 +217,11 @@ export const useAuthStore = create<AuthState>()(
                 const user = await authApi.getMe();
                 await get().checkAdminStatus();
                 applySession(newToken, refreshToken, user);
+              } else if (tokenRefreshManager.lastFailureWasTransport) {
+                // Backend unreachable, not a rejected token — keep the session
+                // (don't wipe tokens) so the ServiceUnavailableScreen can resume
+                // once the backend returns. Just stop the bootstrap loader.
+                set({ isLoading: false });
               } else {
                 clearSession();
               }
@@ -237,6 +242,11 @@ export const useAuthStore = create<AuthState>()(
                 } catch {
                   clearSession();
                 }
+              } else if (tokenRefreshManager.lastFailureWasTransport) {
+                // Backend unreachable, not a rejected token — keep the session
+                // (don't wipe tokens) so the ServiceUnavailableScreen can resume
+                // once the backend returns. Just stop the bootstrap loader.
+                set({ isLoading: false });
               } else {
                 clearSession();
               }

src/store/blocking.ts

@@ -5,6 +5,7 @@ export type BlockingType =
   | 'channel_subscription'
   | 'blacklisted'
   | 'account_deleted'
+  | 'backend_unavailable'
   | null;
 
 interface MaintenanceInfo {
@@ -54,6 +55,9 @@ interface BlockingState {
   setChannelSubscription: (info: ChannelSubscriptionInfo) => void;
   setBlacklisted: (info: BlacklistedInfo) => void;
   setAccountDeleted: (info: AccountDeletedInfo) => void;
+  /** Backend is unreachable (transport-level failure). Renders the full-screen
+   *  ServiceUnavailableScreen. No info payload — the screen shows static copy. */
+  setBackendUnavailable: () => void;
   clearBlocking: () => void;
 }
 
@@ -100,6 +104,15 @@ export const useBlockingStore = create<BlockingState>((set) => ({
       blacklistedInfo: null,
     }),
 
+  setBackendUnavailable: () =>
+    set({
+      blockingType: 'backend_unavailable',
+      maintenanceInfo: null,
+      channelInfo: null,
+      blacklistedInfo: null,
+      accountDeletedInfo: null,
+    }),
+
   clearBlocking: () =>
     set({
       blockingType: null,