fix: handle expired auth sessions on main

[NickMonrad]

Summary

Cherry-picks the expired-auth-session fix from the timeline UX branch onto main so 401 expiry clears both local storage and the in-memory auth context consistently.

Related issue

Closes #233

Changes

• cherry-pick the expired auth session handling from feature/timeline-ux-rework
• add shared auth session helpers so token/user updates stay in sync
• add a client test covering external session clearing and invalid stored payloads

E2E Tests

Tests added/modified:

• None

E2E test results (npm run test:e2e):

Not run for this cherry-pick.

Testing

• npm test passes in /server
• npx tsc --noEmit passes in /server
• npx tsc --noEmit passes in /client
• npm run test:e2e passes (Playwright — requires dev servers on :3001 and :5173)
• e2e/TESTS.md updated to reflect any test additions or changes

Notes

• This is a surgical cherry-pick of commit 0f12fc8 onto main.
• The cherry-pick conflicted in client/src/hooks/useAuth.tsx because main had diverged, so the auth-session fix was merged into the current main shape without changing the existing register flow.