fix(cloud): recover expired sessions and login return

[beruro]

Summary

• clear only the rejected persisted cloud session and show a dedicated expired-session message before join/create actions
• preserve sessions on transient refresh failures and protect newer concurrent logins
• route Settings, Add ORG, invite, and share sign-in CTAs through one app-owned loopback callback flow
• companion web return fix: https://github.com/yorgai/ORGII-cloud-infra/pull/1

Validation

• 6 focused Vitest cases passed for auth refresh states and browser callback handoff
• focused TypeScript check passed for the new auth helpers and tests
• targeted ESLint passed with the existing baseline Tailwind ordering rule excluded
• all 13 navigation locale files parse and include cloud.sessionExpired
• git diff check passed