fix: add JWT parsing and expiration check in local token management

frontend/src/App.tsx

@@ -125,8 +125,35 @@ function generateUUID() {
   return `${hex.substr(0, 8)}-${hex.substr(8, 4)}-${hex.substr(12, 4)}-${hex.substr(16, 4)}-${hex.substr(20, 12)}`
 }
 
+function parseJwtPayload(token: string) {
+  try {
+    const [, payload] = token.split('.')
+    if (!payload) return null
+    const base64 = payload.replace(/-/g, '+').replace(/_/g, '/')
+    const decoded = atob(base64)
+    return JSON.parse(decodeURIComponent(decoded.split('').map((c) => `%${(`00${c.charCodeAt(0).toString(16)}`).slice(-2)}`).join('')))
+  } catch {
+    return null
+  }
+}
+
+function isJwtExpired(token: string) {
+  const payload = parseJwtPayload(token)
+  if (!payload || typeof payload.exp !== 'number') return false
+  return payload.exp < Math.floor(Date.now() / 1000)
+}
+
 function getLocalToken() {
-  return window.localStorage.getItem('oidc_access_token')
+  const token = window.localStorage.getItem('oidc_access_token')
+  if (!token) {
+    return null
+  }
+  if (isJwtExpired(token)) {
+    console.debug('Clearing expired stored token')
+    clearLocalToken()
+    return null
+  }
+  return token
 }
 
 function setLocalToken(token: string) {