fix: drop sessions carrying an expired access token

[cuzzlor]

Stack 3/3 — stacked on #15 (base branch fix/login-unhandled-rejection); the diff shows only this PR's commits. Merging the full stack releases v2.1.0 — this PR includes the minor version bump, so the publish workflow ships both fixes when it lands on main.

Problem

The session cookie can outlive the access token it stores (e.g. a 1h cookie holding a token Entra issued with a shorter lifetime, or any visit after token expiry but before cookie expiry). When that happens:

1. copySessionJwtToBearerHeader keeps copying the expired token to the authorization header, where it fails bearer verification on the resource server → 401/FORBIDDEN.
2. The header's presence suppresses the interactive re-login redirect that apps typically gate on the header being absent (the pattern in this package's README).

The browser is wedged on 401s until the cookie expires or the user manually logs out.

Fix

Decode the token's exp claim — plain base64 payload decode, no signature verification, which remains the resource server's job — and when it has expired, drop the session (req.session = null) and skip the copy. The login middleware then re-runs on the same request, giving the user a transparent SSO redirect instead of a dead end. Unparsable tokens still pass through untouched for downstream bearer verification to judge, exactly as before.

Also bumps the package version to 2.1.0 as the top of the stack.

Testing

Added src/copy-session-jwt-to-bearer-header.spec.ts:

• unexpired token is copied to the header (unchanged behaviour)
• expired token → session dropped, nothing copied
• unparsable token passes through
• existing authorization header and unauthenticated sessions untouched

npm run lint, npm run check-types, and npm test all pass, plus npm run build and npm run audit on the assembled stack.

🤖 Generated with Claude Code

[cuzzlor]

CI here fails only on the audit step — advisories pre-dating this branch (main fails identically). #17 clears them; update this branch after it merges and CI should go green.