fix(auth): refresh token before API calls

.gitignore

@@ -12,3 +12,7 @@ frontend/dist/
 .coverage
 docs/*.md
 AGENTS.md
+
+# Local-only wallpapers (do not commit)
+media/atlas_bg.jpg
+media/titan-iac-bg.png

frontend/src/auth.js

@@ -105,6 +105,14 @@ export async function logout() {
 
 export async function authFetch(url, options = {}) {
   const headers = new Headers(options.headers || {});
+  if (keycloak?.authenticated) {
+    try {
+      await keycloak.updateToken(30);
+      updateFromToken();
+    } catch {
+      // ignore refresh failures; the API will return 401 and the UI can prompt for login
+    }
+  }
   if (auth.token) headers.set("Authorization", `Bearer ${auth.token}`);
   return fetch(url, { ...options, headers });
 }