feat(auth): show a clear 'session expired' overlay on any 401 instead of failing silently

When the session became invalid (server restart, idle timeout, revoked token),
authFetch only console.warn'd the 401 and every poll failed silently — the UI
kept showing stale data with no hint the user had been logged out.

Now any 401 (except /auth/* and /sse) raises a session-expired flag that renders
a clear modal overlay (portalled to body so it sits above everything) with a
'Log in' button that runs logout() -> back to the login screen. Idempotent, so a
burst of concurrent 401s only shows the prompt once. Reuses existing i18n
(sessionExpired + login) — no new keys.

Verified live via Playwright: after forcing API calls to 401, the overlay appears
on the next poll. Rebuilt web/index.html.

Author: MrMasterbay