Refresh the access token on 401 instead of retrying forever

**Problem**

Two separate defects leave a student logged in with a dead session and no way out except finding Log Out.

On a 401 the fetch service recurses into itself with the same expired token: no refresh, no delay, no attempt cap. Since nothing changed, the retry 401s too, forever. In practice the resume picker spins permanently while hammering channeli.in in a tight loop for as long as the app is foregrounded.

Separately, `refreshToken()` runs exactly once, at launch, and swallows every error with a bare `catch`, including "refresh token expired". `authStateListener` only checks that `access` is non-empty, so the app still reports the user as signed in while every screen shows "Something went Wrong".

**Where**

- `lib/services/api_models/fetchService.dart:29-32` (unbounded recursion on 401)
- `lib/services/auth/auth_service.dart:45-58` (`refreshToken`, bare catch at :57)
- `lib/services/auth/auth_service.dart:96` (only caller, at launch)
- `lib/services/auth/auth_service.dart:60-62` (`authStateListener`)

**Expected**

One refresh, one retry, then clear the session and route to sign-in.

**Fix sketch**

- On 401: `await refreshToken()`, retry once, and on a second 401 call `logOut()` and navigate to `/wrapper`.
- Make `refreshToken` return a bool and stop swallowing the failure.
- Also refresh on app resume.

Start with the 401 handling in lib/services/api_models/fetchService.dart:29-32, then trace refreshToken, authStateListener, and its launch caller in lib/services/auth/auth_service.dart:45-62,96. Verify the flow by exercising an expired access token: it should refresh once, retry once, and then clear the session and route to /wrapper; app resume should also trigger refresh.

Written by the indexing model from the issue text.