fix(P1): Frontend stores access token in memory only, refresh token persisted for rotation

fix: Frontend API client uses relative URL by default (same-origin, works with nginx proxy)

feat: Complete project scaffold - backend (FastAPI) + frontend (Next.js 15) + scraper + LLM gateway