fix(limits): distinguish expired Grok sessions from sign-out

[SaneSanders]

Summary

• Grok keeps a 6-hour access token in auth.json and renews it with the stored refresh token on its next start. After 6 idle hours HOME sent the expired token to billing and showed Sign-in required to a signed-in user.
• A selected credential with a refresh token and a past expires_at now reports session-expired (Session expired, launch the CLI) without a billing request. CanvasTTY does not refresh the token itself: Grok rotates the refresh token on every refresh.

Test plan

• npm test (856/856)
• npm run typecheck
• live check with an expired Grok session: Sign-in required (billing 401) → Session expired, launch the CLI, no billing request