fix: persist autoRestoreRan on globalThis to survive Vite HMR (BUG-F7)

Module re-evaluation during HMR reset autoRestoreRan to false, causing
duplicate auth-restore API calls. Now persists flag on globalThis.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

frontend/src/composables/useNostr.ts

@@ -95,8 +95,8 @@ const bot = ref<BotData | null>(loadStored('bf_bot'))
 const profilePicUrl = ref<string | null>(loadStored('bf_pic'))
 const isLoading = ref(false)
 
-// Guard: only auto-restore once across all component mounts
-let autoRestoreRan = false
+// Guard: only auto-restore once — survives Vite HMR module re-evaluation
+let autoRestoreRan = (globalThis as any).__bf_autoRestoreRan ?? false
 // Flag: skip relay pic fetch for freshly generated keys (no profile exists)
 let freshlyGenerated = false
 // In-memory nsec for current session (never auto-persisted to localStorage)
@@ -116,7 +116,8 @@ if (typeof document !== 'undefined') {
 
 // Auto-restore session from JWT on first load
 if (!autoRestoreRan && pubkey.value && !bot.value && getToken() && !isTokenExpired()) {
-  autoRestoreRan = true
+  autoRestoreRan = true;
+  (globalThis as any).__bf_autoRestoreRan = true
   authFetch('/api/auth/login', {
     method: 'POST',
     headers: { 'Content-Type': 'application/json' },
@@ -129,7 +130,8 @@ if (!autoRestoreRan && pubkey.value && !bot.value && getToken() && !isTokenExpir
   }).catch(err => console.warn('[Nostr] auto-restore failed:', err))
 } else if (!autoRestoreRan && pubkey.value && !getToken()) {
   // No JWT — clear stale pubkey from before the JWT migration
-  autoRestoreRan = true
+  autoRestoreRan = true;
+  (globalThis as any).__bf_autoRestoreRan = true
   pubkey.value = null
   store('bf_pubkey', null)
 }