[client] Localize session deadline rejected notification via metadata key

Follow the same pattern as session-warning events: the daemon emits an
empty userMessage and puts the signal in a typed metadata key
(MetaSessionDeadlineRejected); the UI tray detects the key and builds a
locale-aware OS notification from i18n strings.

Changes:
- sessionwatch/event.go: add MetaSessionDeadlineRejected constant
- engine_authsession.go: empty userMessage, use the new metadata key
- ui/authsession/warning.go: re-export MetaDeadlineRejected for UI consumers
- ui/tray_events.go: gate on isDeadlineRejected alongside isSessionWarning;
  new branch calls t.notify with localized title/body
- i18n locales (en/de/hu): add notify.sessionDeadlineRejected.{title,body}

https://claude.ai/code/session_01Y3bQoNgcVjTD4zDTvv7a8u

client/ui/authsession/warning.go

@@ -19,10 +19,11 @@ import (
 // side) so UI-side consumers don't have to import the daemon-internal
 // package directly.
 const (
-	MetaWarning     = sessionwatch.MetaSessionWarning
-	MetaFinal       = sessionwatch.MetaSessionFinal
-	MetaExpiresAt   = sessionwatch.MetaSessionExpiresAt
-	MetaLeadMinutes = sessionwatch.MetaSessionLeadMinutes
+	MetaWarning          = sessionwatch.MetaSessionWarning
+	MetaFinal            = sessionwatch.MetaSessionFinal
+	MetaExpiresAt        = sessionwatch.MetaSessionExpiresAt
+	MetaLeadMinutes      = sessionwatch.MetaSessionLeadMinutes
+	MetaDeadlineRejected = sessionwatch.MetaSessionDeadlineRejected
 )
 
 // Warning is the typed payload emitted on the session-warning Wails

client/ui/i18n/locales/de/common.json

@@ -55,6 +55,8 @@
     "notify.sessionWarning.failed": "NetBird-Sitzung konnte nicht verlängert werden",
     "notify.sessionWarning.successTitle": "NetBird-Sitzung verlängert",
     "notify.sessionWarning.successBody": "Ihre Sitzung wurde erneuert.",
+    "notify.sessionDeadlineRejected.title": "Sitzungsfrist abgelehnt",
+    "notify.sessionDeadlineRejected.body": "Der Server hat eine ungültige Sitzungsfrist übermittelt. Bitte melden Sie sich erneut an.",
 
     "common.cancel": "Abbrechen",
     "common.save": "Speichern",

client/ui/i18n/locales/en/common.json

@@ -55,6 +55,8 @@
     "notify.sessionWarning.failed": "Failed to extend NetBird session",
     "notify.sessionWarning.successTitle": "NetBird session extended",
     "notify.sessionWarning.successBody": "Your session has been refreshed.",
+    "notify.sessionDeadlineRejected.title": "Session deadline rejected",
+    "notify.sessionDeadlineRejected.body": "The server sent an invalid session deadline. Please sign in again.",
 
     "common.cancel": "Cancel",
     "common.save": "Save",

client/ui/i18n/locales/hu/common.json

@@ -55,6 +55,8 @@
     "notify.sessionWarning.failed": "A NetBird munkamenet meghosszabbítása sikertelen",
     "notify.sessionWarning.successTitle": "NetBird munkamenet meghosszabbítva",
     "notify.sessionWarning.successBody": "A munkamenet frissítve.",
+    "notify.sessionDeadlineRejected.title": "Munkamenet-határidő elutasítva",
+    "notify.sessionDeadlineRejected.body": "A szerver érvénytelen munkamenet-határidőt küldött. Kérjük, jelentkezzen be újra.",
 
     "common.cancel": "Mégse",
     "common.save": "Mentés",

client/ui/tray_events.go

@@ -22,11 +22,12 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	if !ok {
 		return
 	}
-	// Session-warning events carry no UserMessage — the tray builds the
-	// localised notification body locally from metadata. Every other
-	// event needs a non-empty UserMessage to show anything meaningful.
+	// Session-warning and deadline-rejected events carry no UserMessage —
+	// the tray builds the localised notification body locally from metadata.
+	// Every other event needs a non-empty UserMessage to show anything meaningful.
 	isSessionWarning := se.Metadata[authsession.MetaWarning] == "true"
-	if !isSessionWarning && se.UserMessage == "" {
+	isDeadlineRejected := se.Metadata[authsession.MetaDeadlineRejected] != ""
+	if !isSessionWarning && !isDeadlineRejected && se.UserMessage == "" {
 		return
 	}
 	if shouldSkipSystemEvent(se) {
@@ -52,6 +53,15 @@ func (t *Tray) onSystemEvent(ev *application.CustomEvent) {
 	//   - T-FinalWarningLead (MetaSessionFinal=true) → auto-open the
 	//     SessionAboutToExpire dialog. No OS notification here; the
 	//     dialog is the last-chance reminder, doubling up would be noise.
+	if isDeadlineRejected {
+		t.notify(
+			t.loc.T("notify.sessionDeadlineRejected.title"),
+			t.loc.T("notify.sessionDeadlineRejected.body"),
+			notifyIDSessionExpired,
+		)
+		return
+	}
+
 	if se.Metadata != nil && se.Metadata[authsession.MetaWarning] == "true" {
 		if se.Metadata[authsession.MetaFinal] == "true" {
 			t.openSessionAboutToExpire()