fix: account page reauth UX, narrow-screen overflow, signout cleanup

[nimish-ks]

🔍 Overview

Stacked on top of #983 — base branch is feat--user-auth-management, so review that first. This is follow-up UX polish from testing the account page locally.

Frontend only. No backend, schema, migration, or dependency changes.

💡 Proposed Changes

Prompt-first re-authentication

Reauth-gated dialogs used to open with a "You'll be asked to confirm it's you before this change is applied" notice inside them, and the sign-in prompt only appeared at submit. The freshness check now runs at click time instead, so the "Confirm it's you" prompt comes first and the user continues the flow normally after re-login.

• Applied the pre-check pattern already used by Enable 2FA and Link provider to the remaining sensitive flows: change email, manage 2FA (regenerate / disable), unlink provider, delete account
• Removed StaleSessionNotice.tsx — the prompt now does its job
• Delete account: dropped the requiresReauth button swap ("Sign in again to continue" vs "Delete account"). That flag is a load-time snapshot, so a session going stale while the page sat open still rendered the delete button and dead-ended at submit; the click-time isFresh() check catches that case
• No backend change — require_fresh_session_graphql on the mutations is still the actual enforcement. This only moves when the user is asked

Login page reauth banner

• Restyled the ?reauth=1 banner from a low-contrast cyan Alert one-liner into an amber panel with a "Confirm it's you" heading, reusing the icon and tokens from the dialog the user just came from
• Removed the toast that fired at the same moment saying the same thing

Narrow-screen fixes

• License card: long UUIDs no longer overflow (min-w-0 on the flex child so it can shrink, plus break-all)
• 2FA manage dialog: Regenerate / Disable buttons no longer compress (shrink-0)
• Delete account button: same

Navigation

• Account page "Back home" → "Back to settings", now pointing at the org settings Account & Security tab. Built from activeOrganisation.name rather than a hardcoded slug, falling back to / when there's no active org

Signout cleanup

• graphQlClient.stop() at the top of handleSignout(), stopping polling and in-flight queries before the logout round trip. Without it, GetOrganisations (10s poll) can fire against an already-invalidated session and 403 — visible after account deletion. Nothing user-facing was broken (Django's HTML 403 lands in Apollo's networkError branch, which doesn't toast), but it removes the log noise and a redundant second logout call

📝 Release Notes

• Improved: You're asked to confirm your identity up front when starting a sensitive account change, rather than partway through it.
• Fixed: Long license IDs and action buttons no longer overflow on narrow screens.

🎯 Reviewer Focus

• DeleteAccountSection.tsx — the requiresReauth removal is the only change with a server-side counterpart. The mutation gate is untouched; this is purely about when the UI asks.
• apollo/client.ts — one line, but it's shared plumbing on every signout path (manual logout, session expiry, deletion).

🧪 Testing

Manual only; no test changes. Verified against the local dev stack in cloud mode — each of the five gated flows (email change, 2FA setup, 2FA manage, unlink, delete) shows the prompt on a stale session and restores correctly after re-login.