Regal Solar Energy_ React

Auth / routing
- Always re-verify the session against /auth/me on app boot, even when the
cookie already holds a user, so a stale cookie role can't send the user
to /unauthorized.
- Store the re-issued token returned by verifyToken when the DB role differs
from the one baked into the stored token, so API calls stop returning 403.
- Fall back to the cookie session on network/server errors (non-4xx) instead
of logging the user out.
- Start authSlice with isLoading=true for cookie-restored sessions, so routing
waits for verification instead of redirecting on stale data.
- getDefaultRoute: only land on /dashboard for ACCESS.PROJECTS roles;
otherwise pick the first protected route the user can actually open.

Power Company Application (Phase 1)
- Move "Refresh from Documents" up beside the document list, highlighted
(yellow, pulsing until used), and drop the old Refresh button and the
lower bill-refresh row.
- Add an amber "refresh before you fill" banner that turns into a green
confirmation once the form has been refreshed from the documents.
- Add a "Scanning the project documents..." ExtractionLoader while parsing.
- Add RefreshDocumentsPrompt, a once-per-visit modal asking staff to refresh
from the utility bill, plan set and system design before filling the form.
- Track refreshed forms per session via refreshedForms state.