Keep people signed in: offline refresh tokens, revoked on sign-out

Rían: low-risk app, signing in again every couple of days isn't worth it.

Today

tasklie-ui sessions are ordinary Keycloak SSO sessions: 14 days idle, 30 days maximum, and no one uses "remember me". Before PAR-559 the app also reused the login-time refresh token, so activity never extended anything.

Change (stacked on PAR-559)

• Request offline_access at login. The client already allows the optional scope, and default-roles-tasklie already grants the role. An offline token isn't bound to the SSO session's idle and maximum limits: the realm's offline sessions expire after 30 days unused and have no maximum lifespan. PAR-559's middleware saves every renewed token, so each visit resets the timer. Net effect: you only sign in again after 30 days away.
• Revoke the refresh token at Keycloak on sign-out (Auth.js events.signOut), so a long-lived token can't outlive a deliberate sign-out.
• Existing sessions pick this up at their next sign-in. No Keycloak realm changes.

Acceptance

• The authorization request asks for offline_access.
• Sign-out revokes the refresh token, and a revocation failure doesn't block sign-out.