Refresh the dashboard session cookie

Issues a fresh vk_org_token cookie for the currently authenticated dashboard user, extending the session for another 8 hours from now.

The dashboard SPA calls this on a periodic timer (and on focus/route change) so users actively working in the app are not hard-logged-out when their original 8h JWT expires mid-task.

The request body is empty — the caller is identified by the existing vk_org_token cookie. On success, the response sets a new vk_org_token cookie (httpOnly, Secure, SameSite=Lax, Max-Age=28800).