fix: improve web auth refresh and mobile tutorials

web/src/lib/auth.ts

@@ -89,6 +89,8 @@ export function isTokenExpired(): boolean {
   return auth.expires_at - 60_000 < Date.now();
 }
 
+let refreshPromise: Promise<AuthData> | null = null;
+
 // --- Helpers ---
 
 function toAuthData(response: SessionResponse): AuthData {
@@ -144,7 +146,7 @@ export async function loginWithEmail(
   return data;
 }
 
-export async function refreshAccessToken(): Promise<AuthData> {
+async function doRefreshAccessToken(): Promise<AuthData> {
   const auth = getAuth();
   if (!auth?.refresh_token) {
     clearAuth();
@@ -165,6 +167,17 @@ export async function refreshAccessToken(): Promise<AuthData> {
   return data;
 }
 
+export async function refreshAccessToken(): Promise<AuthData> {
+  if (refreshPromise) return refreshPromise;
+
+  refreshPromise = doRefreshAccessToken();
+  try {
+    return await refreshPromise;
+  } finally {
+    refreshPromise = null;
+  }
+}
+
 export async function logout(): Promise<void> {
   const auth = getAuth();
   try {