fix(frontend): hide viewer-only risk-compute UI, proactively renew session

- Executive Dashboard no longer auto-triggers POST /risk/compute or shows
  the Refresh scores button for roles the backend rejects (viewer), which
  was causing a 403 on load
- AuthContext now proactively renews the session cookie every 20 minutes
  while the app is open, so an actively-used session doesn't rely solely
  on the reactive on-401 refresh racing against its own token's expiry

frontend/src/context/AuthContext.tsx

@@ -10,6 +10,7 @@ import {
   login as apiLogin,
   logout as apiLogout,
   getMe,
+  refreshToken as apiRefreshToken,
 } from "../api/auth";
 import type { User } from "../types/models";
 import ChangePasswordModal from "../components/ChangePasswordModal";
@@ -45,6 +46,21 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     refreshUser().finally(() => setIsLoading(false));
   }, [refreshUser]);
 
+  // Proactively renew the session cookie while the app is open, so an
+  // actively-used session never actually reaches the hard 8-hour expiry
+  // (relying solely on the reactive on-401 refresh risks losing the race
+  // against the token's own expiry — see api/client.ts).
+  useEffect(() => {
+    if (!user) return;
+    const PROACTIVE_REFRESH_INTERVAL_MS = 20 * 60 * 1000;
+    const id = setInterval(() => {
+      apiRefreshToken().catch(() => {
+        // Reactive on-401 handling in api/client.ts takes over from here.
+      });
+    }, PROACTIVE_REFRESH_INTERVAL_MS);
+    return () => clearInterval(id);
+  }, [user]);
+
   const login = useCallback(async (username: string, password: string) => {
     await apiLogin(username, password);
     const me = await getMe();