- auth.py: replace synchronous httpx.get (blocked event loop) with
async httpx.AsyncClient; add key-rotation refresh on unknown kid
- App.tsx: use onRedirectNavigate: false so Sign out clears only the
local MSAL session without redirecting to Microsoft logout endpoint
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>