fix: normalize session settings and release modal timers

[Jacky-Pham]

The shared session-expiry modal starts a countdown interval each time it mounts but never clears it on unmount. Repeated modal instances leave old countdown timers running. The core layer also takes explicit session timeout values directly from process.env, making its four session settings strings instead of numbers when the documented environment values are supplied.

Keep the countdown interval handle and clear it in the existing unmount hook. Convert the four timeout settings to numbers at the configuration source, preserving millisecond units, existing defaults, empty-value fallback and explicit zero. Existing consumers already coerce numeric strings through division or timers; this change does not establish or claim a prior login failure.

Validation:

• Eight focused tests: four failures and four controls before, all eight pass after. They cover configuration defaults/custom/zero values, countdown/expiry announcements, keyboard dismissal and timer cleanup across unmount/remount.
• Host lint passes. Frozen installs pass in all five packages, and every patched file matches the reviewed source.
• All five dependency locks change only the existing core patch hash. No package version or dependency graph changes.

Paired strict checking on all five packages introduces no new diagnostics: the supplied-example profile improves from 343 to 323 overlapping diagnostics (five session-setting errors removed per consuming app), while default-profile diagnostics remain 342. Other pending repairs are exercised separately on the combined QA branch. Strict gates are still failing.

All five standard frontend workflows pass lint, 768 tests and builds on this head. Combined-source CI 35039423348 passes all five lint/test/build jobs and 1,094 frontend tests on QA 93bf653. Combined strict checking removes the same 20 session diagnostics with no additions: supplied-example profile 70→50; defaults remain 65. Base passes strict checking under both profiles; the four applications still fail. All 37 PR checks are terminal: 22 success and 15 unused npm jobs skipped.

Stacked on #1830; full component and browser sign-off remains open.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud