fix(auth): sign out only after definitive session expiry

[Alae-Tamouh]

Issue #, if available: None

Description of changes:

Problem

When Cognito can no longer refresh a session, API calls fail with 401 but AuthContext retains the previous user. The UI remains authenticated and continues issuing failing requests.
Logging out on every API 401 is unsafe because provider endpoints can also return GitHub, GitLab, Bitbucket, or Jira 401 responses while the Cognito session remains valid.

Reproducer

1. Sign in and open any authenticated page.
2. In another browser tab or through the Cognito administration API, revoke the user's refresh token or invalidate the session.
3. Return to the application after the access token expires and trigger an API request, such as refreshing the spaces list.
4. Observe that the request fails with 401, but the application still considers the previous user authenticated and remains on the protected page.
5. Trigger additional actions and observe repeated 401 responses instead of a return to the login page.

Solution

Classify session resolution as valid, definitively expired, or transiently unavailable. On an API 401, force a Cognito refresh before notifying AuthContext. A small epoch-aware bridge coalesces expiry notifications and prevents late requests from an old session from signing out a newly authenticated local or SSO session.

Impact

Expired users return cleanly to login. Network failures and provider-specific 401 responses no longer cause false logout, and stale requests cannot expire a replacement session.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[jeromevdl]

Great finding @Alae-Tamouh. I never faced this so thank you for your PR.
A few comments before approving.

[JWThewes]

@Alae-Tamouh are you going to work on Jeromes comments? Otherwise I can work on this one. Super great finding an I'm eager to get this one in for our next release.

[Alae-Tamouh]

@JWThewes Thanks for the reminder, I addressed Jerome's comments