fix(auth): preserve existing domain grants on reconnect