[UI-11] Refresh expired OIDC tokens instead of bouncing to login

[PatStLouis]

Surfaced on #175.

In OIDC mode, getUser() returns null as soon as currentUser.expired is true (apps/ui/src/lib/auth/oidc-auth.ts). RequireAuth then sends the user to /login.

App access tokens live 5 minutes (OIDC_ACCESS_TOKEN_TTL_SECONDS). The axios client is built to refresh on 401 (single-flight), and automaticSilentRenew is off on purpose so that interceptor owns refresh. If getUser() treats expiry as logout, the route guard fires first and the interceptor never runs.

Do this as part of #83 (UI-02), not as a separate merge after it:

• Keep the session when the access token expires; still expose getAccessToken() so the 401 handler can refresh.
• Only send the user to /login when refresh fails (onAuthFailure / no refresh token).
• Add a test that an expired access token + valid refresh does not unmount the shell.

Dependencies

• Blocked by [UI-01] React app scaffold and routing #82
• Lands with [UI-02] Login and auth integration #83

Definition of Done

• Implementation complete and builds without errors
• Unit/integration tests pass
• PR reviewed and approved
• No regressions in existing functionality