Same fix as kitchen: AuthGate unconditionally hard-navigated
window.top to the central /login on session expiry, even when not
embedded in the portal iframe — dropping an installed/directly-opened
kds session into the portal's framed browser view instead of staying
in its own window.
Now only bounces to central login when actually embedded (passing
?from= so it returns here afterwards); standalone or directly-opened
tabs get an in-app login form and never navigate away. Also wired up
the inactivity auto-logout timer. The legacy token/restrictedPages/
login/logout compat shim is unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>