fix: suppress expired-token log noise and redirect expired sessions to login (#241)

## Summary

- **Server**: `authMiddleware` no longer calls `logger.error` for expired tokens — expiry is expected behaviour, not an error. Only tampered signatures and malformed tokens (genuinely suspicious) still log.
- **Client**: `fetchJson` now handles 401 responses by clearing `elysium_token` and `elysium_save_signature` from localStorage and redirecting to `/`. Players whose 30-day token has expired will see the login page instead of a stuck "Invalid or expired token" error screen with no recovery path.

Closes #241

✨ This PR was created with help from Hikari~ 🌸

Reviewed-on: #241
Co-authored-by: Hikari <hikari@nhcarrigan.com>
Co-committed-by: Hikari <hikari@nhcarrigan.com>

apps/web/src/api/client.ts

@@ -92,6 +92,11 @@ const fetchJson = async <T>(
       = typeof errorBody.error === "string"
         ? errorBody.error
         : "Unknown error";
+    if (response.status === 401) {
+      globalThis.localStorage.removeItem("elysium_token");
+      globalThis.localStorage.removeItem("elysium_save_signature");
+      globalThis.location.href = "/";
+    }
     if (response.status >= 400 && response.status < 500) {
       throw new ValidationError(message, response.status);
     }