fix: claude auth expiry warning — correct field name and smarter threshold

- Fix 'undefined' in auth banner: read access_token_hours_remaining (not hours_remaining)
- Fix false-positive warning on fresh tokens: when refresh token present, only warn
  within 1 hour of expiry (not 24h) since the CLI should auto-rotate but sometimes misses
- Emit claude_auth_expired SSE event on 401 so UI shows inline red banner immediately
- app.js: handle claude_auth_expired SSE event with persistent top banner + dismiss button

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cortex/routers/auth.py

@@ -20,7 +20,8 @@ router = APIRouter(prefix="/auth")
 CLAUDE_CREDS  = Path.home() / ".claude" / ".credentials.json"
 GEMINI_CREDS  = Path.home() / ".gemini" / "oauth_creds.json"
 GEMINI_ACCTS  = Path.home() / ".gemini" / "google_accounts.json"
-WARN_HOURS = 24
+WARN_HOURS = 24          # no refresh token — warn a day ahead
+WARN_HOURS_REFRESH = 1  # refresh token present — only warn if CLI hasn't rotated in time
 
 
 def _claude_status() -> dict:
@@ -31,11 +32,13 @@ def _claude_status() -> dict:
         expires_dt = datetime.fromtimestamp(oauth["expiresAt"] / 1000, tz=timezone.utc)
         now = datetime.now(tz=timezone.utc)
         hours_remaining = (expires_dt - now).total_seconds() / 3600
-        # If a refresh token is present the session is long-lived (~1 year).
-        # expiresAt only reflects the current access token window (~8 h) and
-        # rotates automatically — do not warn based on it when a refresh token exists.
-        warning = not has_refresh and hours_remaining < WARN_HOURS
-        expired = hours_remaining <= 0 and not has_refresh
+        # When a refresh token is present the CLI *should* auto-rotate the access
+        # token, but sometimes it doesn't.  Use a tight 1-hour window so a fresh
+        # 8-hour token doesn't immediately trigger a warning, but a stale token
+        # that the CLI missed will still surface before it expires.
+        expired = hours_remaining <= 0
+        threshold = WARN_HOURS_REFRESH if has_refresh else WARN_HOURS
+        warning = expired or hours_remaining < threshold
         return {
             "ok": True,
             "has_refresh_token": has_refresh,