Don't show the session-expiry warning to actively-used sessions

The warning was purely a token-expiry countdown with no concept of
user activity, so it interrupted people who had been clicking through
questions the whole time. AuthState now tracks real input activity
globally and silently refreshes the session in the background when
the user has interacted recently, only surfacing the "Stay logged in?"
dialog for sessions that are genuinely idle. A failed background
refresh still surfaces the dialog rather than silently logging the
user out.

scripts/ui/session_expiry_dialog.gd

@@ -117,8 +117,8 @@ func _refresh_succeeded() -> void:
 
 
 func _refresh_failed(message: String, terminal: bool) -> void:
-	if not visible:
-		return
+	visible = true
+	move_to_front()
 	error_label.text = message
 	stay_button.text = "Stay logged in"
 	stay_button.disabled = terminal