test(regression): remove redundant session-expired.spec.ts (covered by api-invalid-key)

All 4 tests are duplicates of better, more focused, and already-@stable
specs:

- Test 1 (GET /flows with invalid Bearer token → 401/403): covered by
  api-invalid-key.spec.ts:41-52 plus 5 additional endpoints exercised
  with invalid tokens in the same file.
- Test 2 (GET /flows without auth header → 401/403): IDENTICAL to
  api-invalid-key.spec.ts:29-38 (same URL, headers, assertion).
- Test 3 (UI login form when auto_login=500): same setup is shared by
  login-invalid-credentials, auto-login-off, and logout-flow — form
  visibility is a precondition implicitly validated everywhere.
- Test 4 (valid token → 200): implicitly validated by every other API
  spec via getAuthToken(); also carries skip-on-missing anti-pattern
  (if (!authToken) return).

Spec name was misleading too — none of the 4 tests simulate session
TTL expiry; the doc itself admitted this on its "does not cover" line.

Author: Daniel Licnerski Borges