Resolve all high-severity architecture review findings

src/ZB.MOM.WW.ScadaBridge.CentralUI/wwwroot/js/session-expiry.js

@@ -21,3 +21,24 @@ export async function ping(url) {
         return 0;
     }
 }
+
+// SignalR event traffic and automatic pings are not user activity. Only trusted
+// browser input can schedule this antiforgery-protected request.
+let lastReported = 0;
+let reporting = false;
+async function recordInput(event) {
+    if (!event.isTrusted || reporting || Date.now() - lastReported < 15000) return;
+    const token = document.querySelector('input[name="__RequestVerificationToken"]')?.value;
+    if (!token) return;
+    reporting = true;
+    try {
+        const response = await fetch('/auth/activity', {
+            method: 'POST', credentials: 'same-origin', cache: 'no-store',
+            headers: { 'RequestVerificationToken': token }
+        });
+        if (response.ok) lastReported = Date.now();
+    } catch { /* A failed request never advances the server's idle clock. */ }
+    finally { reporting = false; }
+}
+for (const name of ['pointerdown', 'keydown', 'wheel', 'touchstart'])
+    document.addEventListener(name, recordInput, { passive: true });