Vest: relay the login's token, never one account's

The Vest app renews each trading account's own token through the same
POST /v3/auth/refresh as the login's (with that account's refresh token
in the body). The extension relayed those too, and the dashboard kept
whichever token lived longest — so while someone traded in an account on
Vest, Me synced with a token that sees that account alone and dropped
the other 24 from the list.

Extension 0.17.2 skips account renewals. The dashboard also refuses a
token that sees one account and no primary (or names that account in
its claims), keeps the last account list, and falls back to the login's
token it replaced. An account gone from Vest's list no longer leaves a
stale position holding the lane.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extension/README.md

@@ -95,6 +95,11 @@ dashboard      POST /api/vest/session  holds it in memory for the firm's Vest cl
 - The hook only reads the Vest app's own `/v3/auth/refresh` and `/register`
   answers. It renews nothing and sends nothing; the session stays the app's,
   so the bot never logs the tab out.
+- It takes the login's token only. The app renews each trading account's own
+  token through the same `/v3/auth/refresh` (with that account's refresh token
+  in the body), and one of those sees a single account. Before 0.17.2 the hook
+  relayed those too, and the dashboard dropped every other account; the
+  dashboard now refuses such a token and falls back to the login's.
 - The token lives ~15 minutes and the app renews it by itself while the tab is
   open. The tab is marked not auto-discardable, since a discarded tab stops
   renewing.