fix(web): refresh expired OIDC tokens before API calls

The overview background graph and the Knowledge Base graph both rendered
empty because the SPA's OIDC access token expired (~5 min TTL) and was
never refreshed. fetchWithAuth called getToken() synchronously (no refresh);
ensureToken returned the stale token without refreshing; storeTokens
discarded expires_in; the resulting 401 made fetchGraph return null and
both graphs drew nothing, with no error surfaced.

- oidc.ts: track expiresAt from expires_in; getToken() returns null within
  30s of expiry; ensureToken/initOIDC refresh instead of returning stale
  tokens; isOIDCConfigured no longer claims configured on expired-only state
- config.ts: fetchWithAuth awaits ensureToken (refresh on demand), falls
  back to static token if OIDC can't yield one, flushes OIDC session on 401;
  sseUrl is async + refreshes before constructing the EventSource
- stores/events.ts: connect() awaits the now-async sseUrl

web/src/lib/stores/events.ts

@@ -20,11 +20,12 @@ export const connectionState = writable<'connecting' | 'open' | 'closed'>('conne
 let source: EventSource | null = null
 let subscriberCount = 0
 
-function connect() {
+async function connect() {
   if (source) return
   connectionState.set('connecting')
-  // The browser's EventSource sends Last-Event-ID automatically on reconnect.
-  source = new EventSource(sseUrl('/api/v1/events/stream'))
+  // The browser's EventSource sends Last-event-ID automatically on reconnect.
+  // sseUrl is async so the OIDC access token is refreshed if expired.
+  source = new EventSource(await sseUrl('/api/v1/events/stream'))
 
   source.onopen = () => connectionState.set('open')