Fix session-expiry redirect breaking standalone PWA out of its shell

Same fix as maintenance/room-planner: manifest scope was the app's
own base path instead of "/", and AuthGate unconditionally hard-
navigated window.top to the central /login on session expiry even
when not embedded in the portal iframe — together these dropped an
installed/standalone reports PWA into the portal's framed browser
view instead of staying in its own window.

AuthGate now only bounces to central login when actually embedded
(passing ?from= so it returns here afterwards); standalone or
directly-opened tabs get an in-app login form and never navigate
away. Also wired up the previously-dead inactivity auto-logout timer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -12,7 +12,7 @@ export default defineConfig({
         name: 'Reports',
         short_name: 'Reports',
         start_url: '/reports/',
-        scope: '/reports/',
+        scope: '/',
         display: 'standalone',
         theme_color: '#1d4ed8',
         background_color: '#1d4ed8',