Sign out cleanly when the Keycloak session can't be refreshed

Problem

When Auth.js can't refresh the Keycloak access token (apps/web/lib/auth/authjs.ts), the jwt callback deletes the access and refresh tokens but keeps the session. The user still looks signed in, but:

• the backend gets no forwarded token, so requests run on the service key instead of as the user;
• the session keeps whatever sub it had, which can be stale.

This showed up on 2026-10-18 when taskl.ie moved from the minecraft realm to the new tasklie realm (https://auth.taskl.ie/realms/tasklie). Existing sessions failed to refresh against the new realm (REFRESH_TOKEN_ERROR invalid_token) and stayed half signed in, under the old user ID with no memberships, until the user signed out by hand.

Fix

• If Keycloak rejects the refresh (4xx, e.g. invalid_grant), end the session (jwt returns null), so requireUser sends the user to /login.
• On a transient failure (network error or 5xx), keep the session and retry on the next request, so a short Keycloak outage doesn't sign everyone out.
• Record the issuer on the token at sign-in, and end any session minted by a different issuer straight away (covers realm switches).
• Update the realm references in comments and .env.example to the tasklie realm.