CVE-2025-24840 — supabase-js session-refresh race condition

A race condition in supabase-js's automatic session-refresh logic could cause two tabs of the same user to receive access tokens belonging to different refresh cycles, confusing server-side authorization state.