feat: Session timeout modal (M2-11002)

[sricharan-varanasi]

📝 Description

🔗 Jira Ticket M2-11002

Warns the user before an idle logout instead of ending the session with no notice.

Changes include:

• A modal at 25 minutes idle, counting down the last 5 before logout
• Stay logged in keeps the session; Log out ends it immediately. Closing the modal keeps the session
• Activity pauses while the modal is open, so moving the mouse toward the buttons cannot answer it for you
• The countdown length is configurable via REACT_APP_IDLE_WARNING_MIN, capped at half the idle timeout
• Answering in one tab closes the modal in the others

📸 Screenshots

Before (Optional)	After

🪤 Peer Testing

Use PR #2257 - it shortens the timings to 3 min idle / 1 min warning so this is observable. On this PR the modal only appears after 25 real minutes.

• Sign in, then leave the machine completely alone for 2 minutes.

  Expected outcome: the modal appears, counting down from 1:00.

• Move the mouse without clicking anything.

  Expected outcome: the countdown keeps running. Activity does not dismiss it.

• Click Stay logged in.

  Expected outcome: the modal closes and you stay signed in past the original 3-minute deadline.

• Trigger it again, then click Log out.

  Expected outcome: logged out immediately, landing on a plain login page.

• Trigger it again and let it run to 0:00.

  Expected outcome: logged out with the soft lock - email pre-filled and a banner explaining why.

• Open two tabs, let both show the modal, click Stay logged in in one.

  Expected outcome: the other tab's modal closes within a second.

✏️ Notes

• Base is session-flag-removal (feat: remove enableSessionKeepAlive flag #2255), which sits on session-sync-local (feat: Share one session across tabs (M2-11052,M2-11002) #2251). Both need to merge first.
• The buttons follow the repo's standard modal pairing (filled primary, text secondary) rather than the two text buttons in Figma, and the title uses Moderat like every other admin modal rather than the Affix in the design. Raised with design.

✅ Checklist

Functionality

• The feature behaves correctly in practice and fulfills the intended business purpose
• The implementation accounts for edge cases, avoids subtle logical errors, and handles somewhat rare failure states (e.g. offline mode for mobile, 3rd party being down, etc)

Testing

• Verify there are automated tests added that meaningfully cover critical behavior and failure cases
• Code coverage does not go down as result of this change
• Test suite passes

Security & Data Privacy

• Verify there is no chance we would accidentally log PII to application logs
• Verify this addition does not materially affect our security attack surface, and if so it has undergone security review
• All inputs are sanitized
• New dependencies are well maintained, have significant justification for being added to the project, and are documented in the Curious open source credit page

Logging/Monitoring

• Logging is implemented for this change such that you could troubleshoot this feature in production
• The change/feature is able to be monitored in production

Performance

• This change does not introduce n+1 queries or other performance issues within our expected scale (e.g. missing indexes on frequently queried columns, frequently updating tables that are accessed often)

Readability

• All commented out code is removed
• Debugging code including extraneous log lines are removed
• Code is easy to understand through naming and structure; comments explain intent or non‑obvious decisions

Change Safety

• Backend changes are backwards compatible with old clients, or it is well known they are not and a deployment/rollout plan is in place. This include backend changes being compatible with old mobile app versions, as well as applet versioning within Curious.
• Destructive database migrations are rolled out in stages. For example, renaming a column means adding a new column and migrating the existing data to that columns in one deployment. Then monitoring to ensure that field isn’t used, and finally removing that old column in a separate deployment.

[aws-amplify-us-east-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-2256.d2ccder08v9rmu.amplifyapp.com

[divbzero]

Changes pushed to #2251.