fix: WebAuthn config typo and improve error handling

- Fix WEBAUTHN_ORIGIN -> WEBAUTHN_ORIGINS env var name
- Add null check for cancelled passkey creation
- Use finally block to ensure loading state is always reset
- Add console.error for better debugging

dashboard/frontend/src/lib/api.js

@@ -23,19 +23,46 @@ export function setRefreshToken() {}
 
 let refreshPromise = null;
 
+function getLegacyRefreshToken() {
+  return localStorage.getItem("refresh_token") || "";
+}
+
+function clearLegacyRefreshToken() {
+  localStorage.removeItem("refresh_token");
+}
+
+async function requestRefresh(body) {
+  const r = await fetch(BASE + "/auth/refresh", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    credentials: "same-origin",
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!r.ok) return false;
+  const data = await r.json();
+  setToken(data.access_token || "");
+  return !!data.access_token;
+}
+
 export async function tryRefreshSession() {
   if (refreshPromise) return refreshPromise;
   refreshPromise = (async () => {
     try {
-      const r = await fetch(BASE + "/auth/refresh", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        credentials: "same-origin",
-      });
-      if (!r.ok) return false;
-      const data = await r.json();
-      setToken(data.access_token || "");
-      return !!data.access_token;
+      const cookieRefreshed = await requestRefresh();
+      if (cookieRefreshed) {
+        clearLegacyRefreshToken();
+        return true;
+      }
+
+      const legacyRefreshToken = getLegacyRefreshToken();
+      if (!legacyRefreshToken) return false;
+      const legacyRefreshed = await requestRefresh({ refresh_token: legacyRefreshToken });
+      if (legacyRefreshed) {
+        clearLegacyRefreshToken();
+        return true;
+      }
+      clearLegacyRefreshToken();
+      return false;
     } catch {
       return false;
     } finally {