feat(admin-web): proactively refresh access tokens before expiry

Track access token expires_at, dedupe concurrent refreshes, retry SSE on
401, and refresh on window focus/visibility so long-lived sessions stop
hitting the login redirect mid-task.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

packages/shared-types/src/index.ts

@@ -17,6 +17,7 @@ export interface ApiErrorEnvelope {
 export interface AuthTokens {
   accessToken: string;
   refreshToken: string;
+  expiresAt?: number;
 }
 
 export interface LoginRequest {