feat: self-refresh Matrix tokens from the account browser session

Expired Matrix bearers no longer pause an account until a new extension
dump is uploaded. BrowserMatrixTokenRefresher loads chat.reddit.com in
the account's persistent browser profile (whose Reddit cookies stay
valid), lifts the fresh bearer off the first authenticated Matrix
request, verifies it via whoami, swaps it into the live MatrixClient
and persists it to the account row.

Wired into the per-account runtime at boot verification, the auth-gate
authenticator, and ChatService's 401 retry path. A dump is now only
needed when the Reddit cookies themselves no longer authenticate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

src/database/account-repositories.ts

@@ -104,6 +104,21 @@ export class RedditAccountsRepository {
     return publicFromPrivate(this.getRequired(input.accountId));
   }
 
+  /** Store a self-refreshed Matrix token without touching cookies or status. */
+  updateMatrixCredentials(
+    accountId: string,
+    matrixCredentialsJson: string,
+    now: number = Date.now(),
+  ): boolean {
+    requireText(accountId, 'accountId');
+    requireJson(matrixCredentialsJson, 'matrixCredentialsJson');
+    return this.db.prepare(`
+      UPDATE reddit_accounts
+      SET matrix_credentials_json = ?, updated_at = ?, last_verified_at = ?
+      WHERE account_id = ? AND status != 'legacy-unassigned'
+    `).run(matrixCredentialsJson, now, now, accountId).changes === 1;
+  }
+
   setActive(accountId: string, active = true, now: number = Date.now()): boolean {
     const status = active ? 'verified' : 'disabled';
     return this.db.prepare(`