Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.
Return a distinct session_idle error from the API and reload to /login with a clear signed-out message.
Squid