[Wilsoon7721]

Fixes #4.

When a refresh fails on a spent token, createAuthMiddleware now only signs out on a navigation. A fetch gets the same redirect to loginPath, but its response no longer expires the cookie, since a request beside it may be writing freshly rotated tokens to that cookie at the same moment. The next navigation retries with whatever the cookie holds by then, and clears it if that refresh fails too.

• packages/auth-next/src/middleware.ts: the catch around refreshAccessToken picks signOut() or a plain redirect by isNavigation.
• Tests: the existing "refresh rejected" test now covers the navigation case and checks the cookie is expired; a new one checks a fetch is turned away with the cookie untouched.
• Released as 3.0.1 for the three kit packages, with a changelog entry and a line in the auth-next README.