feat(desktop): implement client token rotation and session management enhancements

apps/desktop-client/src/main/runtime-events.ts

@@ -1,5 +1,11 @@
 type RuntimeInvalidationReason = 'account-health' | 'publish-task-lease'
 
+type RuntimeAuthExpiredListener = (event: {
+  reason: 'client-auth-expired'
+  at: number
+  message: string
+}) => void
+
 type RuntimeInvalidationListener = (event: {
   reason: RuntimeInvalidationReason
   at: number
@@ -8,6 +14,7 @@ type RuntimeInvalidationListener = (event: {
 }) => void
 
 const listeners = new Set<RuntimeInvalidationListener>()
+const authExpiredListeners = new Set<RuntimeAuthExpiredListener>()
 
 export function emitRuntimeInvalidated(
   reason: RuntimeInvalidationReason,
@@ -37,3 +44,28 @@ export function onRuntimeInvalidated(listener: RuntimeInvalidationListener): ()
     listeners.delete(listener)
   }
 }
+
+export function emitRuntimeAuthExpired(message: string): void {
+  const event = {
+    reason: 'client-auth-expired',
+    at: Date.now(),
+    message,
+  } as const
+
+  for (const listener of authExpiredListeners) {
+    try {
+      listener(event)
+    } catch (error) {
+      console.warn('[desktop-runtime] auth-expired listener failed', {
+        message: error instanceof Error ? error.message : String(error),
+      })
+    }
+  }
+}
+
+export function onRuntimeAuthExpired(listener: RuntimeAuthExpiredListener): () => void {
+  authExpiredListeners.add(listener)
+  return () => {
+    authExpiredListeners.delete(listener)
+  }
+}