fix: demo logins (acme/globex) on Aspire launch + expired-token session restore

[iammukeshm]

Why

On a fresh dotnet run --project src/Host/FSH.Starter.AppHost, logging into the dashboard with the advertised demo accounts (admin@acme.com / Password123!) failed in every browser, including incognito. Two independent defects:

1. Demo tenants were never seeded. AppHost ran only the migrator's apply --seed verb (root tenant/admin only). The acme/globex demo tenants are created solely by the dev-only seed-demo verb, which AppHost never invoked — so the demo-login panel advertised accounts that didn't exist.
2. A stale/expired token booted the app as "signed in." Both React apps derived isAuthenticated from token presence/decodability without checking exp, so a leftover token in localStorage rendered the app and fired protected requests that 401'd in a loop (SecurityTokenExpiredException) instead of refreshing or routing to /login.

What changed

Backend / scaffold

• AppHost: new dev-only fsh-demo-seeder resource runs seed-demo after the base migration; the API waits for it so demo accounts exist before the dashboard is reachable. Idempotent. Pins DOTNET_ENVIRONMENT=Development (the generic-host migrator ignores Aspire's injected ASPNETCORE_ENVIRONMENT) and passes Seed__DemoPassword explicitly.
• DbMigrator: disable build-time DI validation. The migrator runs a deliberately reduced service graph (Mailing/SignalR/Jobs off); Development's auto-on ValidateOnBuild walked request handlers the migrator never invokes (needing IHubContext/IMailService) and crashed startup. The migrator only resolves migration/seed services, so this validation was a false positive (no-op in Production).

Frontend (admin + dashboard, symmetric)

• isTokenExpired added to jwt.ts.
• Auth context now does a one-shot silent refresh at boot when the access token is missing/expired but a refresh token is present (isInitializing), deciding signed-in vs /login before rendering. A live session whose access token expires mid-use stays authenticated (reactive 401-refresh), so the 45-min access / 7-day refresh UX is preserved.
• ProtectedRoute renders a loader while initializing so no request fires with a dead token.
• Exported refreshAccessToken for the boot path.

Tests

• New tests/auth/session-restore.spec.ts in both apps: expired token + refresh-fails → routes to /login; expired token + refresh-succeeds → session restored, no /login bounce. 4/4 pass.
• tsc -b clean for both apps; eslint 0 errors; backend dotnet build clean.

Verification

Relaunching Aspire seeds acme/globex and demo logins succeed; a stale token now silently refreshes or cleanly redirects to /login instead of dumping SecurityTokenExpiredException.

🤖 Generated with Claude Code