feat: keep session alive on Admin ( M2 - 11001 )

[sricharan-varanasi]

• Tests for the changes have been added
• Related documentation has been added / updated
• Delivered the fix or feature branches into develop or release branches via Squash and Merge (to keep clean history)

📝 Description

🔗 Jira Ticket M2-11001

Admin only refreshes its access token reactively today, when a request happens to fail with 401. Once the backend switches web/admin to short-lived tokens, an active user who isn't generating API calls (e.g. typing in a long Builder form) can silently lose their session. There's also no inactivity timeout at all right now.

This adds a background engine, behind a new enableSessionKeepAlive flag (default off):

• While the user is active, it refreshes the token shortly before it expires, so an active session never dies just because it wasn't making API calls.
• If the user goes idle (REACT_APP_IDLE_TIMEOUT_MIN, default 30 min), it logs them out through the existing soft-lock flow - email pre-filled, returned to their page after re-login.
• Both timers read the token's real expiry at decision time rather than assuming a fixed interval, so this stays correct regardless of what lifetime the backend issues.

With the flag off, nothing changes - no timers, no listeners, no extra requests.

Needs the backend token-rotation work merged to test end-to-end (short-lived, rotating tokens for web/admin). Until that lands, keep this flag off in any shared environment - a backgrounded duplicate tab can otherwise log out a tab you're actively using; that fix is a separate follow-up ticket.

🪤 Peer Testing

Requires setting enableSessionKeepAlive to true locally (LaunchDarkly default is false)

• Set short local values, e.g. REACT_APP_IDLE_TIMEOUT_MIN=3, and shorten the backend's web/admin token lifetimes.

  Expected outcome: staying active keeps you logged in past the token's normal lifetime - periodic refresh calls in the network tab, no 401s.

• Log in, then leave the tab untouched past the idle timeout.

  Expected outcome: automatic logout, landing on the login page with your email pre-filled.

• Turn the flag back off and repeat.

  Expected outcome: no refresh calls, no logout - identical to today's behavior.

✏️ Notes

Duplicate-tab sync and the warning-before-logout modal are tracked as separate follow-up tickets.

[aws-amplify-us-east-1]

This pull request is automatically being deployed by Amplify Hosting (learn more).

Access this pull request here: https://pr-2246.d2ccder08v9rmu.amplifyapp.com