fix(web): preserve shell state during auth recovery

[Dumbris]

Remaining low-severity recovery polish from PR #1399’s ZCode review, verified against its final candidate:

• Preserve local header/sidebar state during a fresh authentication probe. canShowShell becomes false while the probe is pending, so the shell remounts on recovery and can clear search text or open dropdowns. Keep the protected-fetch gates fail closed while preserving presentation state where safe.
• Deduplicate badge/profile requests during API-key recovery. The recovered shell loads on mount and markAuthRecovered() can also notify its authEpoch watchers. Add a mounted recovery test that counts requests and preserves the existing authorization boundaries.

Origin: glm:frontend-shell.F2 (ledger S2). The failed-probe blank screen, missing tenant navigation, stale error flag, and reconnect-after-disconnect bugs were fixed in #1399; this issue covers the remaining low-severity remount/request behavior only.