Redirect to session-expired page on invalid or expired Keycloak tokens

[oveldman]

Summary

Adds automatic detection of expired and revoked Keycloak sessions in Portal and Admin. When the API returns 401 or when Keycloak rejects the refresh token with invalid_grant, users are redirected to a localized /session-expired page instead of seeing a raw error. From there they can log in again or log out entirely.

Changes

• UnauthorizedHandler (Controller.Blazor.Shared/Handlers/) — DelegatingHandler registered as the outermost handler on ApiAuthorized; catches 401 HTTP responses and AccessTokenNotAvailableException (Keycloak invalid_grant) and navigates to /session-expired
• WebAssemblyHostBuilderExtensions — registers UnauthorizedHandler before AuthorizationMessageHandler so it wraps the token refresh and can catch exceptions thrown during it
• SessionExpired.razor (Controller.Blazor.Shared/Pages/) — localized [AllowAnonymous] page with two actions: "Log in again" (logout → Keycloak login → redirect to /) and "Log out" (logout → redirect to /)
• Localization — SessionExpired keys added to SharedResources.resx, .nl-NL.resx, and .ja-JP.resx

How to Test

• Log in to Portal or Admin, then invalidate the session in Keycloak (e.g. end the session via the Keycloak admin console or wait for the refresh token to expire)
• Perform any authenticated action (e.g. navigate to a page that calls ApiAuthorized)
• Verify the app redirects to /session-expired showing the localized message
• Click "Log in again" — verify Keycloak login page opens and after login you land on /
• Click "Log out" — verify Keycloak session is ended and you land on /

Checklist

• Code builds without errors
• Changes have been tested locally
• No new warnings introduced

[sonarqubecloud]

Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud