Fix session-expiry redirect breaking standalone PWA out of its shell

Same fix as maintenance/reports/room-planner: manifest scope was the
app's own base path instead of "/", and AuthGate unconditionally
hard-navigated window.top to the central /login on session expiry
even when not embedded in the portal iframe — together these dropped
an installed/standalone wages PWA into the portal's framed browser
view instead of staying in its own window.

AuthGate now only bounces to central login when actually embedded
(passing ?from= so it returns here afterwards); standalone or
directly-opened tabs get an in-app login form and never navigate
away. Also wired up the previously-dead inactivity auto-logout timer.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -12,7 +12,7 @@ export default defineConfig({
         name: 'Wage Costs',
         short_name: 'Wages',
         start_url: '/wages/',
-        scope: '/wages/',
+        scope: '/',
         display: 'standalone',
         theme_color: '#065f46',
         background_color: '#065f46',