Don't show the session-expiry warning to actively-used sessions

The warning was purely a token-expiry countdown with no concept of
user activity, so it interrupted people who had been clicking through
questions the whole time. AuthState now tracks real input activity
globally and silently refreshes the session in the background when
the user has interacted recently, only surfacing the "Stay logged in?"
dialog for sessions that are genuinely idle. A failed background
refresh still surfaces the dialog rather than silently logging the
user out.

scripts/autoload/auth_state.gd

@@ -12,6 +12,7 @@ const EndpointConfig := preload("res://scripts/autoload/api_endpoint_config.gd")
 const DEFAULT_AUTH_BASE_URL := "https://us3q.ranaze.com/api/Auth"
 const WARNING_SECONDS := 120
 const REFRESH_TIMEOUT_SECONDS := 20.0
+const ACTIVE_RECENTLY_SECONDS := 60
 
 var is_logged_in := false
 var username := ""
@@ -32,6 +33,7 @@ var expiry_timer: Timer
 var refresh_request: HTTPRequest
 var session_revision := 0
 var refresh_revision := -1
+var last_activity_unix := 0.0
 
 
 func _ready() -> void:
@@ -46,6 +48,12 @@ func _ready() -> void:
 	refresh_request.timeout = REFRESH_TIMEOUT_SECONDS
 	refresh_request.request_completed.connect(_on_refresh_completed)
 	add_child(refresh_request)
+	last_activity_unix = Time.get_unix_time_from_system()
+
+
+func _input(_event: InputEvent) -> void:
+	last_activity_unix = Time.get_unix_time_from_system()
+
 
 func set_session(new_username: String, token: String, new_refresh_token: String = "", new_role: String = "", token_expiration: String = "", legal: Dictionary = {}) -> void:
 	session_revision += 1
@@ -59,6 +67,7 @@ func set_session(new_username: String, token: String, new_refresh_token: String
 	refresh_in_progress = false
 	refresh_revision = -1
 	warning_active = false
+	last_activity_unix = Time.get_unix_time_from_system()
 	set_legal_state(legal, false)
 	if is_logged_in and expiration_unix > 0.0:
 		expiry_timer.start()
@@ -151,6 +160,10 @@ func _evaluate_expiry() -> void:
 		expire_session("expired")
 		return
 	if remaining <= WARNING_SECONDS:
+		var seconds_since_activity := Time.get_unix_time_from_system() - last_activity_unix
+		if seconds_since_activity <= ACTIVE_RECENTLY_SECONDS and not refresh_in_progress:
+			request_session_refresh()
+			return
 		if not warning_active:
 			warning_active = true
 			session_warning.emit(remaining)