fix: pass refresh_token in body when calling /auth/refresh

The refresh endpoint expects {"refresh_token":"..."} in the POST body,
but the frontend was sending an empty body (EOF error). Now stores the
refresh_token from login response and sends it on refresh requests.

Co-Authored-By: Claude <noreply@anthropic.com>

src/api/auth.ts

@@ -1,4 +1,4 @@
-import { http, setAccessToken } from './client';
+import { http, setAccessToken, setRefreshToken } from './client';
 import type { Profile, Company, UserRole } from '../types';
 
 export interface LoginRequest {
@@ -31,6 +31,7 @@ export const authApi = {
   login: async (data: LoginRequest) => {
     const res = await http.post<LoginResponse>('/auth/login', data);
     setAccessToken(res.data.access_token);
+    setRefreshToken(res.data.refresh_token);
     return res.data;
   },
 
@@ -40,6 +41,7 @@ export const authApi = {
   logout: async () => {
     await http.post('/auth/logout');
     setAccessToken(null);
+    setRefreshToken(null);
   },
 
   refresh: async () => {

src/api/client.ts

@@ -13,12 +13,17 @@ export interface PaginationParams {
 const API_BASE = '/api/v1';
 
 let accessToken: string | null = null;
+let refreshTokenValue: string | null = null;
 let refreshPromise: Promise<boolean> | null = null;
 
 export function setAccessToken(token: string | null) {
   accessToken = token;
 }
 
+export function setRefreshToken(token: string | null) {
+  refreshTokenValue = token;
+}
+
 export function getAccessToken(): string | null {
   return accessToken;
 }
@@ -27,6 +32,8 @@ async function refreshToken(): Promise<boolean> {
   try {
     const res = await fetch(`${API_BASE}/auth/refresh`, {
       method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ refresh_token: refreshTokenValue }),
       credentials: 'include',
     });
     if (!res.ok) return false;