fix: recover expired sessions instead of failing silently

[thermcampos]

Fixes #93

Summary

• A tab left open through sleep/browser throttling missed the 25-minute refresh interval, so every /rest/** request failed with auth errors while the private layout kept rendering. The client now revalidates the session on visibilitychange/focus/online (throttled to once a minute), so a waking tab re-authenticates immediately.
• Any 401/403 on an authenticated request now notifies the auth layer, which signs out and redirects to login while preserving REDIRECT_PATH; public and /auth/** calls (e.g. failed logins) are exempt.
• The refresh endpoint now accepts tokens expired up to 12 hours ago (still bound to the same user and invalidated by password changes), so sleep/wake no longer forces a full re-login.

Verification

• Frontend gate green: lint, build, 169 tests (7 new: wake refresh, 401 sign-out/redirect, API handler scoping).
• Backend gate green: checkstyle, 228 unit + 22 integration tests (10 new: grace-window validation and filter fallback paths).

💘 Generated with Crush