Clear refresh attempt counter on token_refresh_failed

[ryota-murakami]

Summary

sessionStorage attempt counter persists after attempt > MAX_REFRESH_ATTEMPTS, breaking next session.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

When the route bails on attempt > MAX_REFRESH_ATTEMPTS, sessionStorage still reads 2; the next visit bails immediately even though it's a new session.

Fix

Either:

• Clear sessionStorage in /login mount when error=token_refresh_failed query param is present
• Or have the route emit a clearing Set-Cookie signal

Acceptance

• After token_refresh_failed, the next visit retries fresh (attempt=1)
• Test covers the recovery path