feat: handle opaque refresh tokens

On init frontend searches for the refresh token in the local storage.

If a refresh token is available, frontend will try to decode it to identify, if it's still active via exp claim. If it's active, we can directly get a new access token via refresh_token grant.

According to the spec refresh token can be any string.

Keycloak works with JWT tokens, therefore frontend can decode it and extract the exp field.

But some other Identity Providers (such as Kanidm, Authelia) work with opaque refresh tokens. In this case it is not possible to decode the refresh token and find out, if it's still active.

Till now we didn't handle such a case and the app was just crashing, not caughting a decode error.

In this MR fronted caughts the error. In that case, frontend will just ignore the stored refresh token, as if it was not there. And will get a new refresh token via authorization_code grant.

Closes #3314