fix(auth): isolate session races and financial caches

TD-001 and TD-002: serialize cookie writes, ignore stale responses and reset financial
queries on identity changes. Backend cookie lifecycle regression: ec5780d.

src/shared/api/client.test.ts

@@ -64,4 +64,33 @@ describe("apiClient authentication", () => {
 
 		expect(authorization).toBeNull();
 	});
+	it("discards a retried request response after another session takes over", async () => {
+		let generation = 0;
+		let calls = 0;
+		let release!: () => void;
+		const pending = new Promise<void>((resolve) => {
+			release = resolve;
+		});
+		server.use(
+			http.get("*/api/v1/brokerage-accounts", async () => {
+				if (++calls === 1)
+					return HttpResponse.json({ code: "UNAUTHORIZED" }, { status: 401 });
+				await pending;
+				return HttpResponse.json([{ id: "previous-user-account" }]);
+			}),
+		);
+		configureAuthClient({
+			accessToken: () => "synthetic",
+			generation: () => generation,
+			refresh: async () => true,
+			clear: vi.fn(),
+		});
+		const response = expect(
+			apiClient.GET("/api/v1/brokerage-accounts"),
+		).rejects.toMatchObject({ name: "AbortError" });
+		await vi.waitFor(() => expect(calls).toBe(2));
+		generation += 1;
+		release();
+		await response;
+	});
 });