Silent refresh last-resort cause double login

[CozyCozy-Gabor]

Describe the bug
Silent-refresh 'last-resort' handler cause invalid state;

Steps to Reproduce
Use login via popup where window.opener is lost after redirects (triggering the last-resort storage path).
Observe the storage events in the opener window.
tryLogin is first called correctly with the OAuth response, then again with null.

When using the "last resort" fallback in silent-refresh.html (popup without opener reference), the library writes and then immediately removes auth_hash from localStorage.

The current listener in OAuthService does not filter out the second event (message listener does).