Fix silent auth redirect with expired client credentials

[timgent]

This PR fixes bug #4177.

Summary

When handleIncomingRedirect({ restorePreviousSession: true }) is called with stored session data containing an expired client_id, the library now validates client expiration before attempting silent authentication. This prevents the redirect to the OAuth provider with invalid credentials, which previously caused users to be stuck on an error page.

Changes

• Add clientExpiresAt field to ISessionInternalInfo so client expiration data flows through the existing SessionInfoManager.get() → validateCurrentSession() → silentlyAuthenticate() path
• Read expiresAt from storage in the browser SessionInfoManager.get() and return it as clientExpiresAt
• Check expiration inline in silentlyAuthenticate() using the session info fields, rather than a separate method
• Clear stored session when client is expired to prevent retry loops

Design

Rather than adding a separate isClientExpired() method and threading storageUtility through the ClientAuthentication constructor, the expiration timestamp is surfaced as part of the session info that already gets retrieved during silent auth. This keeps the change minimal and avoids extra constructor parameters, mock plumbing, and redundant storage reads.

Checklist

• I've added a unit test to test for potential regressions of this bug.
• The changelog has been updated, if applicable.
• Commits in this PR are minimal and have descriptive commit messages.

🤖 Generated with Claude Code

[NSeydoux]

Thanks for opening this PR! I'll have a look as soon as possible :)

[NSeydoux]

Can this check be moved up to validateCurrentSession?

[timgent]

Yep fair point, will update when I find a few mins 👍

[timgent]

Update pushed 👍

[NSeydoux]

I'm sorry, I didn't realize until now your commits weren't signed. We have a branch protection rule requiring signed commit. I can sign the commit myself, but for proper attribution I'd prefer that you setup signing keys if it's okay with you. Github provides some intructions on how to do this. If it's too much of a bother, I can go ahead with my own signature, but I would prefer you get full credit for your work :)

[timgent]

@NSeydoux sorry for missing that - I've updated the commit so it's now signed. Thanks again for engaging so quickly with the issue and for reviewing this PR!