Refactor authentication and streaming cookie handling: implement secure cookie logic based on environment in AuthEndpoints and StreamingEndpoints, enhance rate limiting policy in Program.cs, and update logging configuration in appsettings.json. Fix validation behavior to use asynchronous validation methods and improve error handling in frontend components.

frontend/src/shared/api/client.ts

@@ -30,7 +30,8 @@ export async function refreshAccessToken(): Promise<boolean> {
       try {
         const response = await fetch('/api/auth/refresh', { method: 'POST', credentials: 'include' })
         if (!response.ok) return false
-        const data = (await response.json()) as { accessToken: string }
+        const data = (await response.json()) as { accessToken?: unknown }
+        if (typeof data?.accessToken !== 'string') return false
         setAccessToken(data.accessToken)
         return true
       } catch {
@@ -77,9 +78,13 @@ export async function apiRequest<T>(path: string, options: RequestOptions = {}):
     body: options.body !== undefined ? JSON.stringify(options.body) : undefined,
   })
 
-  if (response.status === 401 && !options.skipRefresh) {
-    const refreshed = await refreshAccessToken()
-    if (refreshed) return apiRequest<T>(path, { ...options, skipRefresh: true })
+  if (response.status === 401) {
+    if (!options.skipRefresh) {
+      const refreshed = await refreshAccessToken()
+      if (refreshed) return apiRequest<T>(path, { ...options, skipRefresh: true })
+    }
+    // 401 и освежить токен нельзя/не помогло (включая повторный 401 уже после успешного refresh —
+    // токен приняли, но прав нет / он тут же отозван): сессия мертва, чистим авторизацию.
     onUnauthorized?.()
     throw await parseError(response)
   }