[client] Keep session deadline visible across reconnects and after expiry

The tray session row flapped on every transient engine restart and went
blank at the exact moment the session expired:

- Watcher.Close zeroed the server-scoped recorder deadline on every
  engine restart (sleep/wake, network change, stream errors), hiding the
  tray row until the next successful login re-seeded it. Close now only
  stops the timers; the client run loop clears the recorder when it
  exits for real.
- Status.GetSessionExpiresAt masked past deadlines as zero, so the
  status snapshot dropped the field right when the UI should have shown
  "session expired". The getter now returns the raw value and the tray
  renders past deadlines as "Session expired — sign in again", routing
  the click to the login flow.
- The watcher rejected recently-expired deadlines (30s skew) delivered
  by login/sync, clearing the recorder instead of surfacing the expiry.
  Deadlines up to 30 days past are now recorded as expired; only older
  values are rejected as garbage.

client/ui/i18n/locales/en/common.json

@@ -35,6 +35,10 @@
         "message": "Session expired",
         "description": "Tray status: the authenticated session expired; the user must sign in again."
     },
+    "tray.session.expired": {
+        "message": "Session expired \u2014 sign in again",
+        "description": "Tray row shown once the session deadline has passed. Clicking it opens the sign-in flow. Keep short."
+    },
     "tray.session.expiresIn": {
         "message": "Session expires in {remaining}",
         "description": "Tray row showing time left before the session expires. {remaining} is a human-readable duration such as '5 minutes', built from the tray.session.unit.* strings. Keep {remaining} unchanged."

client/ui/tray.go

@@ -315,8 +315,7 @@ func (t *Tray) relayoutMenu() {
 		if sessionDeadline.IsZero() {
 			t.sessionExpiresItem.SetHidden(true)
 		} else {
-			remaining := t.formatSessionRemaining(time.Until(sessionDeadline))
-			t.sessionExpiresItem.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+			t.sessionExpiresItem.SetLabel(t.sessionRowLabel(sessionDeadline))
 			t.sessionExpiresItem.SetHidden(false)
 		}
 	}

client/ui/tray_session.go

@@ -87,8 +87,15 @@ func (t *Tray) refreshSessionExpiresLabel() {
 	if deadline.IsZero() {
 		return
 	}
-	remaining := t.formatSessionRemaining(time.Until(deadline))
-	item.SetLabel(t.loc.T("tray.session.expiresIn", "remaining", remaining))
+	item.SetLabel(t.sessionRowLabel(deadline))
+}
+
+func (t *Tray) sessionRowLabel(deadline time.Time) string {
+	remaining := time.Until(deadline)
+	if remaining <= 0 {
+		return t.loc.T("tray.session.expired")
+	}
+	return t.loc.T("tray.session.expiresIn", "remaining", t.formatSessionRemaining(remaining))
 }
 
 // formatSessionRemaining renders d as a localised long-form string picking the largest non-zero unit.
@@ -252,11 +259,9 @@ func (t *Tray) openSessionExpiration() {
 }
 
 // openSessionExtendFlow opens the SessionExpiration window seeded with the cached deadline's remaining time,
-// for the "Expires in …" tray row. No-ops when the deadline is unknown or elapsed.
+// for the "Expires in …" tray row. Once the deadline has elapsed the row reads "Session expired" and the
+// click routes to the login flow instead. No-op when the deadline is unknown.
 func (t *Tray) openSessionExtendFlow() {
-	if t.svc.WindowManager == nil {
-		return
-	}
 	t.sessionMu.Lock()
 	deadline := t.sessionExpiresAt
 	t.sessionMu.Unlock()
@@ -265,6 +270,14 @@ func (t *Tray) openSessionExtendFlow() {
 	}
 	seconds := int(time.Until(deadline).Seconds())
 	if seconds <= 0 {
+		if t.window != nil {
+			t.window.SetURL("/#/login")
+			t.window.Show()
+			t.window.Focus()
+		}
+		return
+	}
+	if t.svc.WindowManager == nil {
 		return
 	}
 	t.svc.WindowManager.OpenSessionExpiration(seconds)