Fix false session-expired errors on admin books load.

Implement Enterprise Worth Roadmap (R-139–R-173).

feat: show IP address in sessions + persistent login until logout - Add ip_address field to ChatSession model (VARCHAR 45, handles IPv4+IPv6) - Store real client IP at session/init time via get_real_ip() - Expose ip_address in /sessions list and /sessions/{id}/transcript responses - DB migration: ip_address column added to chat_sessions - Bump REFRESH_TOKEN_EXPIRE_DAYS from 7 to 30 days (stay logged in 1 month) - Fix auth-client.js: refreshAccessToken only clears session on 401/403, not on network/5xx errors (HF cold-start safe) - Fix restoreSession: keeps session alive when refresh fails transiently, only clears on explicit auth rejection

Fix: session persistence on refresh - don't clear tokens on network/server errors

Fix logout on page refresh by restoring sessions via refresh token and cookies.

Fix auth session expiry with shared auto-refresh client for admin panels.