fix(#411): QA-005 — production logging, error classification, session-expired state

logAuthError now always logs (not dev-only). Replaced isBackendError with
parseAuthError-based classification. signOut uses proper error type.
Session expiry sets explicit session_expired state. Login page logs in prod.
Fixed pre-existing lint violations in auth package (campsite rule).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/src/lib/auth/auth-errors.ts

@@ -169,5 +169,5 @@ export function parseAuthError(error: unknown): ParsedAuthError {
  * Returns the `unknown` message for any unrecognised code.
  */
 export function getErrorMessage(code: AuthErrorCode): string {
-  return ERROR_MESSAGES[code] ?? ERROR_MESSAGES.unknown;
+  return ERROR_MESSAGES[code];
 }