feat(BL-P2-083): interim session-expired guard for rescoped tokens

[bluejayA]

Summary / 요약

• EN: Interim guard so the 55-minute deterministic failure of rescoped sessions surfaces as `ApiError::SessionExpired` (and `AppEvent::SessionExpired`) instead of being mis-classified as `AuthFailed`. Operators stop guiding users to "check credentials" when the real fix is `:switch-context`, and we get the telemetry that justifies the rollout of BL-P2-052 Part A (full background auto-refresh).
• KR: BL-P2-052 Part A 본격 auto-refresh 전까지 55분 후 rescoped 세션이 결정론적으로 실패하는데, 현재는 `AuthFailed("refresh_token refused...")`로 표면화되어 "자격증명 문제"로 오인됨. interim guard로 `SessionExpired { project }` 변형을 도입해 명시적으로 reauth 안내 + tracing 텔레메트리 확보.

What changed

Layer	Change
`port/error.rs`	New `ApiError::SessionExpired { project: String }` variant
`adapter/auth/keystone.rs::get_token`	Pre-empts the 1-min fast path: when active scope != initial scope AND cached token is within 5-min margin (or missing), short-circuit with `SessionExpired` + `tracing::warn`
`worker.rs::api_error`	Routes `ApiError::SessionExpired` to dedicated `AppEvent::SessionExpired { project }` event
`event.rs`	New `AppEvent::SessionExpired { project }` variant
`app.rs::generate_toast`	Korean reauth toast: " 세션이 만료되었습니다. :switch-context로 재전환하거나 앱을 다시 시작하세요."

TDD trail

• RED: 3 keystone tests fail (`get_token` returns `AuthFailed` or `Ok` instead of `SessionExpired` for rescoped near-expiry cases).
• GREEN: SessionExpired guard wires the short-circuit + 2 funnel tests (worker routing + toast).

Telemetry rationale

`tracing::warn!(project, expires_at, "session_expired")` at the adapter (structured) + `tracing::warn!(operation, project, "session_expired surfaced to UI")` at the worker (op-tagged). Both fire on the same event so log analysts can correlate adapter detection to UI surface. This is the data BL-P2-052 Part A rollout needs ("how often does this fire in production").

Verification

• cargo test → 1509 passed (main = 1504 → +5)
• cargo clippy --all-targets -- -D warnings → clean
• cargo fmt --all -- --check → clean

Out of scope

• Background auto-refresh for rescoped sessions (BL-P2-052 Part A).
• The 5-minute margin is preemptive by design — a rescoped token with 4 minutes left fails fast rather than failing mid-API-call after a long-running operation starts.

Test plan

• DevStack manual: `:switch-context demo` → wait ~55 min (or shorten Fernet TTL) → trigger any API call → confirm toast reads the Korean reauth message AND no audit log entry classifies it as `AuthFailed`.
• Unit: 5 tests (3 guard + 1 funnel + 1 toast)
• Suite: 1509 passing
• Lint: clippy + fmt clean

Refs: 2026-04-21 Codex adversarial-review M1. Parent: BL-P2-052 Part A.

🤖 Generated with Claude Code