fix(web): refresh composer auth token

[iamjr15]

Summary

• request an uncached Clerk token when the home composer submits
• remove the raw lastActiveToken shortcut that could reuse a 60-second JWT after expiry
• let the request wait for Clerk instead of silently timing out token acquisition

Why

Production network evidence showed home-composer thread creation sending JWTs after their exp timestamp. The raw browser token shortcut bypassed Clerk's normal refresh behavior, causing Invalid or expired bearer token before an agent run could start.

Validation

• pnpm turbo skills:build
• pnpm turbo typecheck lint build --force (55/55 tasks)
• pnpm architecture:check
• pnpm deadcode
• git diff --check