feat(frontend): add inactivity-based session timeout (AR-6)

Nila Löberrequested to merge
1053-session-inactivity-timeout-wt into develop

Summary

  • Stop unconditional 4-minute background refresh that kept Keycloak sessions alive indefinitely
  • Refresh session only on user activity (debounced to 2 min)
  • Sign out after configurable idle period (default 55 min, aligning with Keycloak 60-min ssoSessionIdleTimeout)

Closes #1053 (closed)

TR-03187

Implements AR-6 (Session timeout on inactivity)

Test plan

  • Verify active users are not logged out unexpectedly
  • Verify idle session expires after configured timeout
  • Verify background token refresh does not keep idle session alive
  • Verify configurable timeout via NEXT_PUBLIC_SESSION_IDLE_TIMEOUT_SECONDS env var

Merge request reports