Fix isTokenExpired() to validate JWT exp claim instead of presence check

[Copilot]

isTokenExpired() only checked !token, treating any non-null token (including long-expired ones) as valid. This caused unnecessary 401s, potential incorrect auth-gated UI decisions, and degraded UX.

Changes

• auth/api.js — isTokenExpired(): Decodes the JWT payload via atob and compares exp * 1000 against Date.now(). Malformed or missing tokens return true.

export function isTokenExpired(token) {
  if (!token) return true;
  try {
    const payload = JSON.parse(atob(token.split('.')[1]));
    return payload.exp * 1000 < Date.now();
  } catch {
    return true; // invalid token = treat as expired
  }
}

• auth/api.js — detectBaseUrl(): Added typeof window === 'undefined' guard and switched to import.meta.env?.VITE_API_BASE optional chaining to prevent crashes in non-browser (test/SSR) environments.

• auth/api.js: Removed leftover debug console.log that accessed window and import.meta.env unconditionally at module load time.

• auth/__tests__/api.test.js: Replaced the stub 'returns false for non-empty token' test with three real JWT cases: valid token (exp far-future), expired token (exp past), and malformed input.

• Makefile: Added tools/app-shell/src/auth/__tests__/*.test.js to the test target — these tests existed but were never wired into make test.