feat(nav): add header navigation and show Steam ID on dashboard

Header links to Dashboard, Library and Settings. The logo, the login page and
the landing page lead logged-in users to the dashboard. Expired tokens are
removed, and a 403 on the dashboard logs out. Remove the dev dummy token.

src/utils/auth.test.js

@@ -0,0 +1,27 @@
+import {describe, expect, it} from 'vitest';
+import {isTokenValid} from './auth.js';
+
+const tokenWithPayload = (payload) => {
+    const encode = (obj) => btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+    return `${encode({alg: 'EdDSA'})}.${encode(payload)}.signature`;
+};
+
+describe('isTokenValid', () => {
+    const now = Date.UTC(2026, 8, 24, 12, 0, 0);
+
+    it('accepts a token that expires in the future', () => {
+        expect(isTokenValid(tokenWithPayload({exp: now / 1000 + 60}), now)).toBe(true);
+    });
+
+    it('rejects an expired token', () => {
+        expect(isTokenValid(tokenWithPayload({exp: now / 1000 - 60}), now)).toBe(false);
+    });
+
+    it('rejects a token without exp', () => {
+        expect(isTokenValid(tokenWithPayload({sub: 'a@b.de'}), now)).toBe(false);
+    });
+
+    it.each([null, '', 'not-a-jwt', 'a.%%%.c'])('rejects %j', (token) => {
+        expect(isTokenValid(token, now)).toBe(false);
+    });
+});