feat(auth): tell the user when the session expired

Every 401 from Auth or Core now goes through useSessionExpired: the login page
says the session expired and returns to the last page after login. App no
longer removes a token that only the browser clock calls expired, so a backend
401 is the one signal. A 403 on the profile now shows an error instead.

src/utils/auth.test.js

@@ -1,5 +1,5 @@
 import {describe, expect, it} from 'vitest';
-import {isTokenValid} from './auth.js';
+import {isTokenValid, safeReturnPath} from './auth.js';
 
 const tokenWithPayload = (payload) => {
     const encode = (obj) => btoa(JSON.stringify(obj)).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
@@ -25,3 +25,14 @@ describe('isTokenValid', () => {
         expect(isTokenValid(token, now)).toBe(false);
     });
 });
+
+describe('safeReturnPath', () => {
+    it.each(['/library?status=PLAYING', '/library/220', '/settings'])('keeps the internal path %s', (path) => {
+        expect(safeReturnPath(path)).toBe(path);
+    });
+
+    it.each([undefined, null, '', 'library', '//evil.example', '/\\evil.example', '/\t/evil.example', '/\n/evil.example', 'https://evil.example', '/login', '/login?x=1'])(
+        'rejects %j', (path) => {
+            expect(safeReturnPath(path)).toBeNull();
+        });
+});