fix(auth): 401 dal backend svuota la sessione e segnala session_expired (#25)

api_client._handle_response: su 401 pulisce la sessione Flask e marca
g.session_expired. Un solo after_request (app.py) trasforma le pagine HTML
rimaste in piedi con un errore generico in un redirect al login con flash;
le route JSON/AJAX che già inoltrano il dict di api_client (measure.py,
statistics.py) ricevono session_expired nel corpo insieme al 401.
Backend (riuso della key, bcrypt a tempo costante) resta al lotto A2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/blueprints/statistics.py

@@ -48,7 +48,10 @@ def _proxy_statistics(endpoint: str):
     resp = api_client.get(f"/api/statistics/{endpoint}", params=params)
 
     if isinstance(resp, dict) and resp.get("error"):
-        return jsonify({"error": True, "detail": resp.get("detail", "")}), resp.get("status_code", 500)
+        error_body = {"error": True, "detail": resp.get("detail", "")}
+        if resp.get("session_expired"):
+            error_body["session_expired"] = True
+        return jsonify(error_body), resp.get("status_code", 500)
 
     return jsonify(resp)
 
@@ -101,7 +104,10 @@ def api_subtasks():
     resp = api_client.get("/api/statistics/subtasks", params=params)
 
     if isinstance(resp, dict) and resp.get("error"):
-        return jsonify({"error": True, "detail": resp.get("detail", "")}), resp.get("status_code", 500)
+        error_body = {"error": True, "detail": resp.get("detail", "")}
+        if resp.get("session_expired"):
+            error_body["session_expired"] = True
+        return jsonify(error_body), resp.get("status_code", 500)
 
     # Response is a list
     if isinstance(resp, list):