fix(frontend): hide viewer-only risk-compute UI, proactively renew session

- Executive Dashboard no longer auto-triggers POST /risk/compute or shows
  the Refresh scores button for roles the backend rejects (viewer), which
  was causing a 403 on load
- AuthContext now proactively renews the session cookie every 20 minutes
  while the app is open, so an actively-used session doesn't rely solely
  on the reactive on-401 refresh racing against its own token's expiry

frontend/src/api/auth.ts

@@ -35,6 +35,11 @@ export async function getMe(): Promise<User> {
   return data;
 }
 
+/** Silently renew the session cookie. Throws if there is nothing to renew. */
+export async function refreshToken(): Promise<void> {
+  await client.post("/auth/refresh");
+}
+
 /** Change the current user's password. */
 export async function changePassword(
   currentPassword: string,