TASK-004: Bootstrap frontend auth state from backend session check

Validates session on app mount by calling GET /api/auth/session instead of relying
solely on cached sessionStorage. This ensures the UI state always reflects server
reality — expired or revoked sessions are detected immediately.

Changes:
- Backend: Add GET /api/auth/session endpoint (requires valid session, returns 200/401)
- Frontend: Add useSessionValidation hook for mount-time validation
- Frontend: Add SessionValidationLoading component for validation spinner
- Frontend: Update AuthProvider to call validation on mount with loading state
- Frontend: Add validateSession API function
- Docs: Update Features.md with session validation behavior
- Docs: Update Web-Development.md with session validation pattern

Handles three outcomes:
1. Valid session (200): Proceed with cached state
2. Invalid session (401): Clear sessionStorage and redirect to login
3. Network error: Don't logout (backend may be temporarily unreachable)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Docs/Features.md

@@ -30,6 +30,14 @@ A web application to monitor, manage, and configure fail2ban from a clean, acces
 - After entering the correct password the user is taken to the page they originally requested.
 - A logout option is available from every page so the user can end their session.
 
+### Session Validation on App Load
+
+- On app mount (page reload or initial load), the frontend validates the cached session with the backend by calling `GET /api/auth/session`.
+- While the validation check is in flight, a loading spinner is displayed to avoid UI flicker.
+- If the backend returns **200**, the session is valid and the app proceeds normally.
+- If the backend returns **401**, the session has expired or been revoked (server-side DB deletion, restart, etc.), and the user is logged out and redirected to the login page.
+- If a **network error** occurs (backend temporarily unreachable), the user is not logged out — the app assumes the backend will recover and continues with the cached session state. The next API call will trigger a 401 if the session is actually invalid.
+
 ---
 
 ## 3. Ban Overview (Dashboard)