Persistent access via globally waived JWT expiration

Insufficient session expiration in File Browser 2.50.0 through 2.63.21 allows remote authenticated users to retain protected access. In http/auth.go, renewableErr treats jwt.ErrTokenExpired as renewable for proxy authentication with a non-default logout page, and withUser applies that exception to every protected route without requiring the proxy to continue asserting the token's identity. A previously valid signed token is required; its existing permissions bound access to protected files and, for administrator tokens, administrative settings and indefinite token renewal.