Bound mobile session refresh so reconnect can recover

[phucnguyen1707]

Fix

Draft follow-up to #98; not a mobile release approval.

A stalled shared auth refresh could keep startup and all API/reconnect callers waiting indefinitely. Add a 10-second AbortController deadline around fetch/body processing, matching the existing logout timeout convention.

Treat timeout as a transient failure and preserve stored credentials. Keep epoch guards, single-flight cleanup and serialized secure-storage writes unchanged. Clear the timer before storage writes; no automatic retry is added.

Verification

• Twelve new regressions failed before the fix and now pass.
• Full mobile suite: 212/212; parent also reran it in a network-isolated namespace.
• Tests execute actual auth/session, AuthProvider and both WebRTC hooks with transport/storage/media boundary doubles. Cover stalled fetch/body, deduplication, timeout cleanup, logout/new-login races and explicit reconnect.
• Whole-mobile TypeScript/lint and scoped formatting passed.
• Claude Opus approved this diff only from source/evidence; no native or real Supabase execution was claimed.

Remaining Gates

• Native abort/background-timer behavior and actual refresh-token rotation need verification. If the server rotates a token but its response is lost/times out, re-login may be needed.
• This bounds network I/O while JS timers run, not OS suspension or a stalled secure-store operation. Body-phase abort is modeled in tests and is not proof of native XHR behavior.
• No native call, capture, EAS build, store submission or production deployment was performed. Keep draft until these limits are reviewed.