Refresh the dashboard session cookie

Issues a fresh `vk_org_token` cookie for the currently authenticated dashboard user, extending the session for another 8 hours from now. The dashboard SPA calls this on a periodic timer (and on focus/route change) so users actively working in the app are not hard-logged-out when their original 8h JWT expires mid-task. The request body is empty — the caller is identified by the existing `vk_org_token` cookie. On success, the response sets a new `vk_org_token` cookie (httpOnly, Secure, SameSite=Lax, Max-Age=28800).