feat: Share session between tabs via BroadcastChannel (M2-11052)

[sricharan-varanasi]

• Tests for the changes have been added
• Delivered the fix or feature branches into develop or release branches via Squash and Merge (to keep clean history)

📝 Description

🔗 Jira Ticket M2-11052

Follow-up to (#2246). Each tab currently runs its own keep-alive engine and knows nothing about the others, so a backgrounded tab hits its own idle deadline and logs out and under token rotation that revokes the whole family, killing the tab actually in use. A new tab also always shows the login page even when a session is live next door.

This makes tabs of the same session talk to each other over a BroadcastChannel.

Changes include:

• New sessionSync module - one channel, and a message protocol scoped by session id (the refresh token's family claim, falling back to jti)
• Rotated tokens, activity and logout are shared between tabs of the same session
• A new tab asks for live sessions on boot and adopts the most recent one; tabs that already have a session are never switched
• A tab that was frozen or discarded catches up on wake/reload instead of spending a stale refresh token

Behaviour is unchanged while enableSessionKeepAlive is off - nothing is sent or received.

🪤 Peer Testing

Requires the enableSessionKeepAlive flag on, and a backend with token rotation.

• Sign in, then open a second tab

  Expected: lands on the dashboard, no login page

• Leave two tabs on the login page, sign in as User 1 in one and User 2 in the other, then open a third tab

  Expected: third tab is User 2; the first two are untouched and keep working as their own user

• Log out User 2, then open a new tab

  Expected: new tab is User 1 - only live sessions are offered

• Duplicate a tab, background the duplicate, keep working in the original past the idle timeout

  Expected: neither tab logs out, and only one refresh call per cycle

• Log out manually in one tab

  Expected: other tabs of that session log out too

• Leave every tab idle past the timeout

  Expected: soft-locked login page with the email pre-filled

• Turn the flag off

  Expected: new tabs show the login page, no channel traffic in either direction

✏️ Notes

• Stacked on session-keep-alive- please review with that as the base. Will rebase onto develop once feat: keep session alive on Admin ( M2 - 11001 ) #2246 merges.
• The flag stays off until this lands; keep-alive without tab sync is what causes the cross-tab logout.