fix(auth): не отдавать SSO с просроченным JWT и не бить /me

getToken чистит expired; при плохом return_to остаёмся на login без /me.

Co-authored-by: Cursor <[email protected]>

apps/web/src/lib/auth.ts

@@ -1,3 +1,5 @@
+import { isJwtExpired } from '@authportal/shared'
+
 const TOKEN_KEY = 'authportal_token'
 
 /** Fallback if /api/v1/auth/config unavailable (dev). Includes `private` for LAN SSO. */
@@ -37,7 +39,13 @@ export async function ensureReturnToAllowlist(): Promise<string> {
 }
 
 export function getToken(): string | null {
-  return localStorage.getItem(TOKEN_KEY)
+  const token = localStorage.getItem(TOKEN_KEY)
+  if (!token) return null
+  if (isJwtExpired(token)) {
+    localStorage.removeItem(TOKEN_KEY)
+    return null
+  }
+  return token
 }
 
 export function setToken(token: string) {

apps/web/src/routes/index.tsx

@@ -32,6 +32,8 @@ export const Route = createFileRoute('/')({
         await new Promise(() => {})
         return
       }
+      // return_to present but not allowlisted — stay on login, do not hammer /me
+      return
     }
 
     try {