feat(admin-web): proactively refresh access tokens before expiry

Track access token expires_at, dedupe concurrent refreshes, retry SSE on
401, and refresh on window focus/visibility so long-lived sessions stop
hitting the login redirect mid-task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/main.ts

@@ -51,6 +51,7 @@ import {
 
 import App from "./App.vue";
 import { i18n } from "./i18n";
+import { subscribeAuthExpired } from "./lib/session";
 import { router } from "./router";
 import { pinia } from "./stores/pinia";
 import "./styles.css";
@@ -70,6 +71,18 @@ const queryClient = new QueryClient({
 
 const app = createApp(App);
 
+subscribeAuthExpired(() => {
+  const current = router.currentRoute.value;
+  if (current.name === "login") {
+    return;
+  }
+
+  void router.replace({
+    name: "login",
+    query: current.fullPath ? { redirect: current.fullPath } : undefined,
+  });
+});
+
 const IconFont = createFromIconfontCN({ 
   // 需要替换为你自己真实项目的 js 地址，才能显示出你的 '#icon-line-global_undo'。
   scriptUrl: "//at.alicdn.com/t/c/font_5154382_922oh81rh1.js",