Fix media authentication and promise rejection handling

Fix unhandled promise rejections from encrypted media decrypt failures and ensure OIDC token refresh propagates new tokens to the service worker.

Author: Just-Insane

.changeset/fix-media-error-handling.md

@@ -2,4 +2,4 @@
 default: patch
 ---
 
-Fix unhandled promise rejections from encrypted media decrypt failures, and wire OIDC token refresh to propagate new tokens to the service worker so authenticated media requests no longer 401 after token expiry.
+Properly handle OIDC/SSO refresh tokens to resolve media auth issues