fix(auth,supabase): recover from client corruption after tab suspension

[KrunchMuffin]

Summary

Fixes the Supabase client becoming irrecoverably corrupted after browser tab suspension (2-5+ minutes), which affects PWAs, mobile browsers, and long-lived sessions. After resuming:

• auth.getSession() could return null despite a valid session in storage
• functions.invoke() could hang indefinitely (blocked on lock-gated getSession)
• Realtime channels failed silently with stale tokens and no reconnection

Root cause: When _recoverAndRefresh fails with a retryable error (e.g. network still reconnecting after tab resume), no auth event was emitted, leaving realtime and functions permanently desynchronized. The next auto-refresh tick could be up to 30 seconds away.

Changes

auth-js (GoTrueClient):

• Emit SIGNED_IN with current session on retryable refresh failure so downstream listeners (realtime, functions) can re-sync immediately instead of silently dropping the error
• Trigger an immediate _autoRefreshTokenTick() after visibility change recovery instead of waiting up to AUTO_REFRESH_TICK_DURATION_MS (30s) for the next scheduled tick

supabase-js (SupabaseClient):

• Add visibilitychange listener that force-syncs a fresh token to the realtime client when the tab resumes — acts as a safety net for cases where the auth event bridge misses the token update

Test plan

• New unit test: should sync fresh token to realtime on visibility change (tab resume) in SupabaseClient tests
• All existing realtime-js tests pass (325/325, only pre-existing worker test failures on non-browser env)
• All existing supabase-js unit tests pass (88/88)
• Manual testing: open app with realtime channel, background tab for 3-5 min, resume and verify session + realtime recover

Related

Closes supabase/supabase#36046

🤖 Generated with Claude Code

[gfsaaser24]

This looks solid. Nice work dude.

[mandarini]

The reason why I do not want to merge this PR (or similar PRs) is that they are patching a deeper issue with how we use the Web Lock API and navigator locks. We have discussed this internally with the team quite a lot. While we appreciate all your contributions, we do want to come up with a solution to the root of the problem.
Would you like to try out 2.103.1-beta.0? It's a release for this PR #2235.