feat: enforce IPSIE session_expiry ceiling on local session lifetime

- Add session_expiry?: number to IdToken type
- Add SESSION_EXPIRY_LEEWAY_SECONDS = 30 to constants
- Reject at login if session_expiry <= iat
- Enforce ceiling on every session read: getUser, getIdTokenClaims,
  and getTokenSilently all return undefined once ceiling is reached
- Skip /oauth/token refresh-token call when ceiling has passed
- Pin ceiling at login value across refreshes — refresh response
  is authoritative for tokens only, never for the ceiling

Author: yogeshchoudhary147