Session expiry turns the app into a zombie — the 12h JWT dies mid-use, the UI stays up, and every invoke times out

The `didi_session` cookie lives 30 days, the JWT inside ~12h, and nothing calls `/api/session/refresh` — the transport 4401-loops at 2/sec.