🔐 Add session timeout and auto-logout for security

[jobbykings]

Summary

Users remain logged in indefinitely. A session timeout should log them out after a period of inactivity.

Tasks

• Implement inactivity timer (default: 30 minutes)
• Show warning modal 2 minutes before timeout
• Auto-logout and clear sensitive state on timeout
• Allow users to configure timeout duration in settings

Acceptance Criteria

• Session expires after configured inactivity period
• Warning shown before expiry