Session expiry turns the app into a zombie — the 12h JWT dies mid-use, the UI stays up, and every invoke times out

The didi_session cookie lives 30 days but the JWT inside lives ~12h, and nothing in the shell ever calls /api/session/refresh — so a working session silently crosses the cliff, the transport 4401-loops at 2/sec, and the operator diagnoses a dead database.