fix: suppress expired-token log noise and redirect expired sessions to login

- authMiddleware no longer logs token expiry as an error; only tampered
  or malformed tokens (genuinely suspicious) trigger logger.error
- fetchJson clears elysium_token and elysium_save_signature from
  localStorage and redirects to / on any 401, so players with expired
  sessions see the login page instead of a stuck error screen

apps/api/test/middleware/auth.spec.ts

@@ -6,18 +6,26 @@ vi.mock("../../src/services/jwt.js", () => ({
   verifyToken: vi.fn(),
 }));
 
+vi.mock("../../src/services/logger.js", () => ({
+  logger: {
+    error: vi.fn().mockResolvedValue(undefined),
+  },
+}));
+
 describe("authMiddleware", () => {
   beforeEach(() => {
     vi.resetModules();
+    vi.clearAllMocks();
   });
 
   const makeApp = async () => {
     const { authMiddleware } = await import("../../src/middleware/auth.js");
     const { verifyToken } = await import("../../src/services/jwt.js");
+    const { logger } = await import("../../src/services/logger.js");
     const app = new Hono<{ Variables: { discordId: string } }>();
     app.use("*", authMiddleware);
     app.get("/test", (c) => c.json({ discordId: c.get("discordId") }));
-    return { app, verifyToken };
+    return { app, logger, verifyToken };
   };
 
   it("returns 401 when Authorization header is missing", async () => {
@@ -45,8 +53,8 @@ describe("authMiddleware", () => {
     expect(body.discordId).toBe("user_123");
   });
 
-  it("returns 401 when verifyToken throws", async () => {
-    const { app, verifyToken } = await makeApp();
+  it("returns 401 and logs when verifyToken throws a non-expiry error", async () => {
+    const { app, logger, verifyToken } = await makeApp();
     vi.mocked(verifyToken).mockImplementationOnce(() => {
       throw new Error("Invalid token");
     });
@@ -54,10 +62,15 @@ describe("authMiddleware", () => {
       headers: { Authorization: "Bearer bad_token" },
     }));
     expect(res.status).toBe(401);
+    /* eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- logger mock requires cast */
+    expect((logger.error as ReturnType<typeof vi.fn>)).toHaveBeenCalledWith(
+      "auth_middleware",
+      expect.any(Error),
+    );
   });
 
-  it("returns 401 when verifyToken throws a non-Error value", async () => {
-    const { app, verifyToken } = await makeApp();
+  it("returns 401 and logs when verifyToken throws a non-Error value", async () => {
+    const { app, logger, verifyToken } = await makeApp();
     vi.mocked(verifyToken).mockImplementationOnce(() => {
       throw "raw string error";
     });
@@ -65,5 +78,23 @@ describe("authMiddleware", () => {
       headers: { Authorization: "Bearer bad_token" },
     }));
     expect(res.status).toBe(401);
+    /* eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- logger mock requires cast */
+    expect((logger.error as ReturnType<typeof vi.fn>)).toHaveBeenCalledWith(
+      "auth_middleware",
+      expect.any(Error),
+    );
+  });
+
+  it("returns 401 without logging when token has expired", async () => {
+    const { app, logger, verifyToken } = await makeApp();
+    vi.mocked(verifyToken).mockImplementationOnce(() => {
+      throw new Error("Token has expired");
+    });
+    const res = await app.fetch(new Request("http://localhost/test", {
+      headers: { Authorization: "Bearer expired_token" },
+    }));
+    expect(res.status).toBe(401);
+    /* eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- logger mock requires cast */
+    expect((logger.error as ReturnType<typeof vi.fn>)).not.toHaveBeenCalled();
   });
 });