Fix auth errors, CORS, control center login, and stale session handling

- Mitra auth: parse DioException response for proper error messages
  (ACCOUNT_NOT_FOUND, ACCOUNT_INACTIVE) instead of generic "OTP invalid"
- Backend: add CORS to internal app (port 3001) for control center
- Control center: fix login race condition (wait for AuthContext verify
  before navigating), fix MitraActivityPage fetching paginated data
- Stale session goodbye: both apps detect SESSION_NOT_ACTIVE/409 and
  move to complete state instead of retrying endlessly

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

client_app/lib/core/chat/session_closure_notifier.dart

@@ -1,3 +1,4 @@
+import 'package:dio/dio.dart';
 import 'package:flutter_riverpod/flutter_riverpod.dart';
 import 'package:riverpod_annotation/riverpod_annotation.dart';
 import '../api/api_client_provider.dart';
@@ -67,6 +68,13 @@ class SessionClosure extends _$SessionClosure {
         'message': message,
       });
       state = const ClosureCompleteData();
+    } on DioException catch (e) {
+      final code = e.response?.data?['error']?['code'];
+      if (code == 'SESSION_NOT_ACTIVE' || e.response?.statusCode == 409) {
+        state = const ClosureCompleteData();
+      } else {
+        state = const ClosureErrorData('Gagal mengirim pesan penutup.');
+      }
     } catch (e) {
       state = const ClosureErrorData('Gagal mengirim pesan penutup.');
     }