Improve session security feedback with replay attack and revocation messages

[tjementum]

Summary & Motivation

Previously, users were silently redirected to the login page whenever their session ended, with no explanation of what happened. Now users see a dedicated error page with a clear message explaining why they were logged out:

• Security alert: When a replay attack is detected (someone attempted to reuse an old token)
• Session ended: When a user's session was revoked from another device
• Session expired: When the session could not be found or has expired

This improves user experience by providing context and reassurance, especially in security-sensitive situations like replay attack detection.

Supporting changes:

• Add x-unauthorized-reason header to 401 responses so frontend can determine the logout reason
• Add user.session_id to Application Insights and OpenTelemetry for session-based troubleshooting
• Fix replay attack detection race condition where concurrent refresh requests could fail due to EF Core change tracking conflicts - now uses atomic ExecuteUpdateAsync that succeeds for one request and is a no-op for others
• Disable the Revoke button while a session is being revoked to prevent double-click issues
• Honor skipQueryInvalidation flag in TanStack Query's MutationCache to prevent sessions modal from refetching when closed

Checklist

• I have added tests, or done manual regression tests
• I have updated the documentation, if necessary

[linear]

PP-355 Show context-specific error pages when session is revoked

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
3 Accepted issues

Measures
0 Security Hotspots
22.4% Coverage on New Code
0.7% Duplication on New Code

See analysis details on SonarQube Cloud