feat(auth): add server-backed demo sessions

The browser treated sessionStorage as the source of truth for the logged-in
user and never verified or invalidated the server-side session cookie: no
GET /api/v1/demo/session or POST /api/v1/demo/logout endpoint existed, and a
central 401 handler was defined but never wired up.

Add both endpoints; the session-check response is marked Cache-Control:
no-store to avoid the browser serving a stale "authenticated" response right
after logout. AuthProvider now verifies against the server on every mount
(sessionStorage only caches presentation state to avoid a login-screen
flash), subscribes to a central 401 listener on the API client, and
RequireAuth shows a loading state during verification instead of flashing
protected content or the wrong role.

.env.example

@@ -10,6 +10,10 @@ POSTGRES_PASSWORD=mobilityops
 APP_SECRET=replace-in-production
 DEMO_TODAY=2026-08-01
 TZ=Europe/Brussels
+# Session cookie Secure flag. Keep false for LAN/plain-HTTP deployments (including the
+# current Unraid review environment); set true only once MobilityOps is served over HTTPS,
+# otherwise browsers will silently drop the cookie and no one can log in.
+SESSION_COOKIE_SECURE=false
 
 # n8n
 N8N_BASE_URL=http://n8n:5678