Partner users being logged out after ~30 minutes due to IP whitelist failure on token refresh

Problem

Partner users are seeing "client ip (missing) was not found on whitelist" after switching to another browser tab for 20-30 minutes and returning. This is causing confusion as users believe they have lost their session, when partner sessions are designed to last 16 hours without re-login.

Solution

Two issues to fix:

1. Keep the refreshToken heartbeat alive during tab inactivity

2. Fix error discrimination in the whitelist middleware