fix: Critical runtime bug - TokenRefreshHandler JS interop in Blazor Server

**Problem:**
TokenRefreshHandler (DelegatingHandler) runs on a non-circuit thread.
ILocalStorageService (JS interop) only works during component render.
Production: 401 response → token refresh → JS interop fails silently.

**Solution:**
1. ITokenStore - Scoped in-memory token store (no JS interop)
   - Properties: AccessToken, RefreshToken, TokenExpiryTicks
   - Method: IsAccessTokenExpired()

2. TokenStore implementation
   - Replaces localStorage as primary token source
   - DelegatingHandler reads/writes only to TokenStore
   - Pages reload → GetAuthenticationStateAsync restores from localStorage

3. CustomAuthenticationStateProvider
   - Accepts ITokenStore injection
   - LoginAsync: Write to both TokenStore + localStorage
   - LogoutAsync: Clear both
   - GetAuthenticationStateAsync: Read from TokenStore first, fallback to localStorage

4. AdminDashboardClient BaseAddress fix
   - Was: new Uri("/taxbaik/api/") - relative URI (runtime error)
   - Now: Configured in Program.cs as absolute URI
   - Program.cs: AddHttpClient(..., client => client.BaseAddress = new Uri("http://localhost:5001/taxbaik/api/"))

**Architecture:**
- TokenStore: Scoped in-memory (DelegatingHandler use)
- localStorage: Persistent (page reload recovery)
- Pattern: Server-side token management without JS interop

This fixes the cascading failure that would occur on any 401 in production.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

TaxBaik.Web/Services/CustomAuthenticationStateProvider.cs

@@ -7,12 +7,18 @@ namespace TaxBaik.Web.Services;
 public class CustomAuthenticationStateProvider : AuthenticationStateProvider
 {
     private readonly ILocalStorageService _localStorage;
+    private readonly ITokenStore _tokenStore;
     private readonly AuthService _authService;
     private readonly ILogger<CustomAuthenticationStateProvider> _logger;
 
-    public CustomAuthenticationStateProvider(ILocalStorageService localStorage, AuthService authService, ILogger<CustomAuthenticationStateProvider> logger)
+    public CustomAuthenticationStateProvider(
+        ILocalStorageService localStorage,
+        ITokenStore tokenStore,
+        AuthService authService,
+        ILogger<CustomAuthenticationStateProvider> logger)
     {
         _localStorage = localStorage;
+        _tokenStore = tokenStore;
         _authService = authService;
         _logger = logger;
     }
@@ -21,14 +27,31 @@ public class CustomAuthenticationStateProvider : AuthenticationStateProvider
     {
         try
         {
-            var accessToken = await _localStorage.GetItemAsStringAsync("accessToken");
+            var accessToken = _tokenStore.AccessToken;
+
+            // TokenStore가 비어있으면 localStorage에서 복원 (페이지 리로드 후)
+            if (string.IsNullOrEmpty(accessToken))
+            {
+                accessToken = await _localStorage.GetItemAsStringAsync("accessToken");
+                if (!string.IsNullOrEmpty(accessToken))
+                {
+                    var refreshToken = await _localStorage.GetItemAsStringAsync("refreshToken");
+                    var ticksStr = await _localStorage.GetItemAsStringAsync("tokenExpiry");
+                    if (long.TryParse(ticksStr, out var ticks))
+                    {
+                        _tokenStore.AccessToken = accessToken;
+                        _tokenStore.RefreshToken = refreshToken;
+                        _tokenStore.TokenExpiryTicks = ticks;
+                    }
+                }
+            }
 
             if (string.IsNullOrEmpty(accessToken))
             {
                 return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
             }
 
-            if (IsTokenExpired(accessToken))
+            if (_tokenStore.IsAccessTokenExpired())
             {
                 _logger.LogWarning("Access token 만료됨");
                 await LogoutAsync();
@@ -53,18 +76,31 @@ public class CustomAuthenticationStateProvider : AuthenticationStateProvider
 
     public async Task LoginAsync(string accessToken, string refreshToken, int expiresIn)
     {
+        var tokenExpiryTicks = DateTime.UtcNow.AddSeconds(expiresIn).Ticks;
+
+        // TokenStore에 저장 (DelegatingHandler에서 사용)
+        _tokenStore.AccessToken = accessToken;
+        _tokenStore.RefreshToken = refreshToken;
+        _tokenStore.TokenExpiryTicks = tokenExpiryTicks;
+
+        // localStorage에도 저장 (페이지 리로드 후 복원)
         await _localStorage.SetItemAsStringAsync("accessToken", accessToken);
         await _localStorage.SetItemAsStringAsync("refreshToken", refreshToken);
-        await _localStorage.SetItemAsStringAsync("tokenExpiry",
-            DateTime.UtcNow.AddSeconds(expiresIn).Ticks.ToString());
+        await _localStorage.SetItemAsStringAsync("tokenExpiry", tokenExpiryTicks.ToString());
+
         NotifyAuthenticationStateChanged(GetAuthenticationStateAsync());
     }
 
     public async Task LogoutAsync()
     {
+        // TokenStore 초기화
+        _tokenStore.Clear();
+
+        // localStorage 초기화
         await _localStorage.RemoveItemAsync("accessToken");
         await _localStorage.RemoveItemAsync("refreshToken");
         await _localStorage.RemoveItemAsync("tokenExpiry");
+
         NotifyAuthenticationStateChanged(GetAuthenticationStateAsync());
     }