feat(ui/auth): redirect to /login when the session times out

Previously a user idling past the 30-minute cookie expiry stayed parked
on a stale page until they tried to navigate. The auth cookie's UTC
expiry is now also stamped onto an expires_at claim at sign-in, and a
SessionExpiry component mounted in MainLayout schedules a delay until
expiry + 2s grace, then force-loads /login — at which point the standard
cookie middleware confirms the session is gone and serves the login page.

src/ScadaLink.CentralUI/Components/Layout/MainLayout.razor

@@ -25,3 +25,5 @@
 @* Global host for IDialogService. One instance per layout renders all confirm/prompt
    dialogs raised via IDialogService.ConfirmAsync / PromptAsync. *@
 <DialogHost />
+
+<SessionExpiry />