fix(session): refresh tokens 30s before expiry instead of 5m

Refreshes are activity-based and synchronous-on-expiry, so the proactive
leeway only hides refresh latency and provides retry headroom; it is not
what prevents serving expired tokens. Shrink it from 5m to 30s to align
with identity provider guidance against refreshing long before expiry,
while keeping decent end-user UX.

pkg/session/data.go

@@ -14,7 +14,7 @@ import (
 
 const (
 	RefreshMinInterval = 1 * time.Minute
-	RefreshLeeway      = 5 * time.Minute
+	RefreshLeeway      = 30 * time.Second
 )
 
 type EncryptedData struct {

pkg/session/data_test.go

@@ -195,7 +195,7 @@ func TestMetadata_ShouldRefresh(t *testing.T) {
 		metadata := session.Metadata{
 			Tokens: session.MetadataTokens{
 				RefreshedAt: time.Now().Add(-5 * time.Minute),
-				ExpireAt:    time.Now().Add(time.Minute),
+				ExpireAt:    time.Now().Add(15 * time.Second),
 			},
 		}
 
@@ -273,7 +273,7 @@ func TestMetadata_ShouldRefresh(t *testing.T) {
 			},
 			Tokens: session.MetadataTokens{
 				RefreshedAt: time.Now().Add(-5 * time.Minute),
-				ExpireAt:    time.Now().Add(time.Minute),
+				ExpireAt:    time.Now().Add(15 * time.Second),
 			},
 		}