perf: replace useSearchParams() with window.location.search in effects

Components were calling useSearchParams() at the top level but only
reading the value inside useEffect or callbacks, never in JSX. This
subscribed the entire component tree to every URL query change.

Fix: read from window.location.search directly inside the effect so
no React subscription is created.

Changes:
- new-chat/page.tsx: read commentId inside effect + popstate listener
  for SPA back/forward support; removes subscription from 1500+ line tree
- dashboard/page.tsx: read window.location.search at redirect time;
  removes searchParams from dep array
- public-chat-footer.tsx: one-shot mount read for action=clone param
- TokenHandler.tsx: one-shot mount read for token + refresh_token params

Implements Vercel React Best Practices Rule: rerender-defer-reads (5.2)

surfsense_web/components/TokenHandler.tsx

@@ -1,6 +1,5 @@
 "use client";
 
-import { useSearchParams } from "next/navigation";
 import { useEffect } from "react";
 import { useGlobalLoadingEffect } from "@/hooks/use-global-loading";
 import { getAndClearRedirectPath, setBearerToken, setRefreshToken } from "@/lib/auth-utils";
@@ -26,8 +25,6 @@ const TokenHandler = ({
 	tokenParamName = "token",
 	storageKey = "surfsense_bearer_token",
 }: TokenHandlerProps) => {
-	const searchParams = useSearchParams();
-
 	// Always show loading for this component - spinner animation won't reset
 	useGlobalLoadingEffect(true);
 
@@ -35,9 +32,13 @@ const TokenHandler = ({
 		// Only run on client-side
 		if (typeof window === "undefined") return;
 
-		// Get tokens from URL parameters
-		const token = searchParams.get(tokenParamName);
-		const refreshToken = searchParams.get("refresh_token");
+		// Read tokens from URL at mount time — no subscription needed.
+		// TokenHandler only runs once after an auth redirect, so a stale read
+		// is impossible and useSearchParams() would add a pointless subscription.
+		// (Vercel Best Practice: rerender-defer-reads 5.2)
+		const params = new URLSearchParams(window.location.search);
+		const token = params.get(tokenParamName);
+		const refreshToken = params.get("refresh_token");
 
 		if (token) {
 			try {
@@ -74,7 +75,7 @@ const TokenHandler = ({
 				window.location.href = redirectPath;
 			}
 		}
-	}, [searchParams, tokenParamName, storageKey, redirectPath]);
+	}, [tokenParamName, storageKey, redirectPath]);
 
 	// Return null - the global provider handles the loading UI
 	return null;