Show a login notice when a session ends due to idle timeout.

Return a distinct session_idle error from the API and reload to /login with a clear signed-out message.

service/internal/api/middleware.go

@@ -2,6 +2,7 @@ package api
 
 import (
 	"context"
+	"errors"
 	"net/http"
 	"strings"
 
@@ -76,7 +77,11 @@ func (app *App) withMiddleware(next http.Handler) http.Handler {
 		security := effectiveSecurity(settingsPayload.Security)
 		session, err := app.Sessions.LookupValidSession(writer, request, security)
 		if err != nil {
-			writeJSON(writer, http.StatusUnauthorized, apiErrorResponse{Error: "authentication required"})
+			errorMessage := "authentication required"
+			if errors.Is(err, auth.ErrSessionIdle) {
+				errorMessage = "session_idle"
+			}
+			writeJSON(writer, http.StatusUnauthorized, apiErrorResponse{Error: errorMessage})
 			return
 		}