On initial render, AuthProvider now attempts a silent token renewal when it
finds a stored user whose access token has expired but user has a refresh token if autologin is disabled.

Why

In the init effect, userManager.getUser() returns the stored user and the
expired branch is entered via (!user || user.expired). Previously that branch
only had two outcomes for an expired user:

• autoSignIn: true → an immediate full-page signinRedirect, even though a
  valid refresh token was available and a silent renewal would have sufficed.
• autoSignIn: false → nothing happened, so userData was left null and the
  app treated the user as logged out despite a renewable session.

Neither path used the refresh token, so a user with an expired access token but
a valid refresh token was unnecessarily bounced to the provider (or shown as
signed out).

Change

In the init effect, when there is an existing expired user and no auth code
in the URL and autologin is disabled, call userManager.signinSilent().