[ISSUE #1002] fix(auth): honor persisted session timeout

[Aias00]

Summary

• derive newly issued token TTLs from the persisted session timeout, with a validated 30-minute fallback
• periodically reclaim expired in-memory sessions instead of waiting for another login
• keep studio.auth.login-required deployment-controlled and replace the non-functional UI switch with an explicit configuration notice

Verification

• JAVA_HOME=$( /usr/libexec/java_home -v 21 ) mvn -q test
• npm test -- --run src/api/generalSettings.test.ts
• npm run lint
• npm run build
• git diff --check

Closes #1002

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[Aias00]

Superseded by #968, which now includes the session lifecycle fix and closes #1002.