fix(#688): route expired auth sessions to sign-in (#689)

* fix(#688): route expired auth sessions to sign-in

Adopt global 401 latch, WS disconnect, and Back/profile guards.

* chore: clean up formatting noise

* fix(ktlint): reorder imports to place java and kotlinx at end

* fix(ktlint): place java.io.IOException at end of imports

* test: fix NavBackStack type parameter in AuthenticationRoutingTest

* test: add AuthSessionState tests to AuthLoginViewModelTest

* fix(ktlint): fix import order in AuthLoginViewModelTest

app/src/main/java/com/m57/hermescontrol/data/local/AuthSessionState.kt

@@ -0,0 +1,31 @@
+package com.m57.hermescontrol.data.local
+
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+
+/**
+ * Single source of truth for app-wide auth session expiry latch.
+ * When a REST call returns 401 (AuthExpired), [requireSignIn] is invoked,
+ * triggering central navigation reset to [AuthLoginScreen] and WS disconnect.
+ */
+object AuthSessionState {
+    private val _signInRequired = MutableStateFlow(false)
+    val signInRequired: StateFlow<Boolean> = _signInRequired.asStateFlow()
+
+    fun requireSignIn() {
+        _signInRequired.value = true
+    }
+
+    fun markAuthenticated() {
+        _signInRequired.value = false
+    }
+
+    fun clearSignInRequired() {
+        _signInRequired.value = false
+    }
+
+    fun resetForTest() {
+        _signInRequired.value = false
+    }
+}