Fix session-token recovery after cookie expiry

[kopy]

• init() recovery was vetoed by the missing-token guard in #handleRefreshRequest: after the 5-min cbo_session_token cookie expires (tab discard/close, reload), no refresh was attempted even though the HTTP-only refresh session was still valid, forcing a full re-login
• init() now calls #refresh() directly for the recovery attempt; interval/visibility paths keep the guard, so logged-out users are not polled
• #setApisV2 moved before the recovery attempt; previously the initial refresh could run on the unconfigured default UsersApi (placeholder host, no credentials) and always fail
• #refresh() no longer logs out on transient network failures (e.g. wake from sleep before connectivity is back); the 10s scheduled refresh retries. Logout still happens on real backend rejections
• setSession keeps the stored refresh-token on the API client when a refresh response carries none; the old post-refresh #setApisV2 call in init() restored it accidentally, and the reordering above removed that safety net — without this, payload-mode (localStorage refresh-token, no cookie) loses Authorization after the first refresh
• behavior note: a cold load with no session now issues one refresh attempt that 401s for anonymous visitors before settling on LoggedOut