Fix auth refresh retry loop on expired tokens

The 401 interceptor was re-triggering itself when the refresh call
also returned 401, causing repeated requests before eventually
logging out. Add guards to skip refresh for the refresh endpoint
itself and prevent any request from retrying more than once.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/services/api.ts

@@ -18,12 +18,14 @@ api.interceptors.request.use(config => {
 api.interceptors.response.use(
   response => response,
   async error => {
-    if (error.response?.status === 401) {
+    const originalRequest = error.config
+    if (error.response?.status === 401 && !originalRequest._retry && !originalRequest.url?.includes('/auth/refresh')) {
+      originalRequest._retry = true
       const authStore = useAuthStore()
       try {
         await authStore.refreshToken()
-        error.config.headers.Authorization = `Bearer ${authStore.token}`
+        originalRequest.headers.Authorization = `Bearer ${authStore.token}`
-        return api(error.config)
+        return api(originalRequest)
       } catch {
         authStore.logout()
         router.push('/login')