web: fix reset password token flow and auth interceptor

docs/backend-web-android-parity.md

@@ -0,0 +1,55 @@
+# Backend/Web/Android Parity Snapshot (2026-03-09)
+
+## 1) Backend vs Web
+
+Backend покрывает web-функционал почти полностью (`~95-100%`):
+
+- `auth`: login/refresh/me, register, verify-email, resend verification, request/reset password, sessions, 2FA
+- `chats`: list/detail, saved, discover, create/join/leave, members/bans, title/profile, pin/archive, invite-link, notifications, clear/delete
+- `messages`: list/send/edit/delete, status, search/thread, forward/bulk, reactions
+- `media`: upload-url, attachments create/list
+- `realtime`: websocket + typing/read/delivered/ping-pong
+- `users`: search/profile/blocked/contacts
+- `search`: global search
+- `notifications`: list
+
+Вывод: текущие проблемы в основном на стороне клиентской интеграции/UX, не backend-contract.
+
+## 2) Web endpoints not yet fully used on Android
+
+- `GET /api/v1/chats/saved`
+- `PATCH /api/v1/chats/{chat_id}/title`
+- `PATCH /api/v1/chats/{chat_id}/profile`
+- `POST /api/v1/chats/{chat_id}/archive`
+- `POST /api/v1/chats/{chat_id}/unarchive`
+- `POST /api/v1/chats/{chat_id}/pin-chat`
+- `POST /api/v1/chats/{chat_id}/unpin-chat`
+- `DELETE /api/v1/chats/{chat_id}`
+- `POST /api/v1/chats/{chat_id}/clear`
+- `GET /api/v1/chats/{chat_id}/notifications`
+- `PUT /api/v1/chats/{chat_id}/notifications`
+- `GET /api/v1/messages/{message_id}/thread`
+- `GET /api/v1/search` (single global endpoint; Android uses composed search calls)
+- Contacts endpoints:
+  - `GET /api/v1/users/contacts`
+  - `POST /api/v1/users/{user_id}/contacts`
+  - `POST /api/v1/users/contacts/by-email`
+  - `DELETE /api/v1/users/{user_id}/contacts`
+- `GET /api/v1/notifications`
+- `POST /api/v1/auth/resend-verification`
+
+## 3) Practical status
+
+- Backend readiness vs Web: `high`
+- Android parity vs Web (feature-level): `~70-80%`
+
+## 4) Highest-priority Android parity step
+
+Подключить в Android реальные действия для chats list popup/select:
+
+- archive/unarchive
+- pin/unpin chat
+- delete/clear chat
+- chat notification settings
+
+и перевести текущие UI-заглушки на API-вызовы.