Session and auth hardening

- Single refresh engine: the server now owns the refresh-token family end to end.
- Silent session restore via refresh cookie keeps user identity stable across syncs.
- Closed silent security-net gaps in infrastructure alerting.
- Pricing honesty pass, auth-credential hygiene, a working noindex mechanism for auth-gated routes, and copy/SEO cleanup.