Merge origin/dev into feature/agent-devices

Keeps the feature branch's side of both conflicts: the browser import in login.ts, and auth.ts's rule that a failed refresh never deletes the stored session (from #258).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: riglar