FEATURE: Reload page to go to login when user session expires; drop obsolete dev-deps

[JamesAlias]

Reload the page when the backend session expires

closes #12

Why

When a Neos backend session times out, the core UI pops up a client-side ReloginDialog that lets the user re-authenticate in place. That dialog can't complete a 2FA challenge — accounts with a second factor get stuck, unable to finish the relogin from inside the editor.

This PR replaces that flow for our users: instead of the in-place dialog, the page reloads and hands off to the server-side login flow, which does know how to handle 2FA.

How

A small Neos UI plugin registers a single redux-saga:

• It listens for the core's @neos/neos-ui/System/AUTHENTICATION_TIMEOUT action — the same 401-triggered action that would otherwise open the ReloginDialog — and calls window.location.reload().
• The action type is read from the exported actionTypes constant (not a hardcoded string) so we stay bound to the core contract; the type is identical in Neos 8 and 9.

The plugin lives in Resources/Private/Neos.Ui/ (TypeScript, bundled with esbuild) and is wired into the Neos UI via Configuration/Settings.yaml. The esbuild config aliases shared deps (notably redux-saga) to the host runtime via extensibilityMap — bundling a private copy would give redux-saga different effect Symbols, so the host middleware would never recognize our take() and the saga would silently never fire.

Build setup

New frontend toolchain under Resources/Private/Neos.Ui/:

• package.json with build / watch / typecheck scripts (esbuild + TypeScript)
• .nvmrc (Node v24.14.1), .npmrc (min-release-age supply-chain guard), tsconfig.json, type shims for the Neos UI modules
• Compiled output committed to Resources/Public/Neos.Ui/Plugin.js

Tests

E2E scenario in login.feature covering the full path: log in → destroy the session server-side (flow:session:destroyAll) → trigger an authenticated UI backend request → assert the page lands back on the login screen. The request is issued through the core's own fetchWithErrorHandling to faithfully reproduce what the UI does on any backend interaction.

Cleanup

Dropped the obsolete sandstorm/neos-init-e2e-tests-plugin dev-dependency and its allow-plugins entry from composer.json.