fix(auth): prevent infinite refresh loop on invalid auth token

[davidecavaliere]

Summary

• Show user-friendly "Session Expired" dialog when auth token becomes invalid
• Fix GET /logout to properly clear session (previously only redirected without clearing)
• Save URL hash before logout so users return to the same page after re-login
• Add flag to prevent multiple session expired dialogs from concurrent failed requests

Problem

When auth token was manually deleted or became invalid, the frontend would enter an infinite refresh loop. This was caused by:

1. API calls returning "Token not valid"
2. CountlyHelpers.logout() calling window.location.reload()
3. Page reloading with session cookie still present
4. Repeat indefinitely

Solution

1. Changed logout() to redirect to /logout endpoint instead of reloading
2. Fixed GET /logout route to call membersUtility.logout() to properly clear session
3. Added session expired dialog with "Go to Login" button
4. Preserve URL hash in sessionStorage so users return to their original page after re-login

Test plan

• Delete auth token from MongoDB while logged in
• Verify no infinite refresh loop occurs
• Verify user is redirected to login page
• Verify after re-login, user returns to the same page they were on

🤖 Generated with Claude Code

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.