feat(session): preserve intended URL across session timeout and add expiry warning dialog

When a session expires, the user's current URL is now captured and restored
after re-authentication (via remember-me cookie or manual login), instead of
always redirecting to the dashboard. A JavaScript session warning dialog
appears ~2 minutes before idle timeout, allowing users to extend their session
with a single click. Includes open-redirect prevention via URL validation,
Microsoft SSO callback support, and 33 unit tests.

Refs: SESSION-REDIRECT-PRESERVE-001

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/Http/AccessControl.php

@@ -58,6 +58,12 @@ class AccessControl
      *
      * @return bool True if access is allowed, false if redirected
      */
+    /**
+     * Redirect to login if the path requires authentication and user is not logged in.
+     * Appends ?return_to= so the user is redirected back after login.
+     *
+     * @return bool True if access is allowed, false if redirected
+     */
     public function requireAuthOrRedirect(string $path, bool $isLoggedIn): bool
     {
         if ($this->isPublicPath($path) || $isLoggedIn) {
@@ -65,7 +71,13 @@ class AccessControl
         }
 
         $locale = I18n::$locale ?? I18n::$defaultLocale;
-        Router::redirect(Request::withLocale('login', $locale));
+        $loginPath = Request::withLocale('login', $locale);
+
+        $requestUri = $_SERVER['REQUEST_URI'] ?? '';
+        $intendedUrlService = app(IntendedUrlService::class);
+        $loginTarget = $intendedUrlService->buildLoginRedirect($loginPath, $requestUri);
+
+        Router::redirect($loginTarget);
 
         return false;
     }