[Frontend] Prevent stale refresh responses from restoring a logged-out session

## Problem

An in-flight token refresh can race logout or account changes and write obsolete credentials back into state.

## Relevant code

`src/contexts/AuthContext.tsx`

## Proposed scope

Use generation/cancellation guards and test logout, account switch, expiry, and concurrent refresh races.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start by reading src/contexts/AuthContext.tsx and reproduce or characterize the stale refresh race with a focused automated test. Cover logout, account switching, expiry, concurrent refreshes, success, loading, empty, failure, and boundary cases; done means the guards are implemented, regression coverage is included, and related tests pass without weakening TypeScript, lint, authorization, privacy, or error handling.

Written by the indexing model from the issue text.