feat: add web UI, query engine, session management, and 20 E2E tests

- Web UI: login, dashboard, links CRUD, collections, API keys, admin pages
- Query engine: AND/OR/XOR with field filters, tag search, preview endpoint
- Session management: token expiry detection, 401 interceptor, expiry banner
- Links search: tags included, multi-word AND, query mode with set operations
- Collections: static/dynamic, query builder with preview, public tree view
- Save as Collection: convert search results (static) or query (dynamic)
- Dashboard stats: resilient loading with allSettled pattern
- Login page: redesigned with public collections tree view
- Bug fix: query executor None fields crash (notes/description/url/title)
- E2E tests: 20 Playwright tests covering all critical user flows
- All 104 tests passing (84 unit/integration + 20 E2E)

LinkSyncServer/static/js/main.js

@@ -1,8 +1,40 @@
 document.addEventListener("DOMContentLoaded", function () {
     const apiBase = "/api";
 
+    function isTokenExpired(token) {
+        try {
+            const payload = JSON.parse(atob(token.split('.')[1]));
+            const now = Math.floor(Date.now() / 1000);
+            return payload.exp ? now >= payload.exp : false;
+        } catch {
+            return true;
+        }
+    }
+
+    function getTokenExpirySeconds(token) {
+        try {
+            const payload = JSON.parse(atob(token.split('.')[1]));
+            const now = Math.floor(Date.now() / 1000);
+            return payload.exp ? payload.exp - now : 0;
+        } catch {
+            return 0;
+        }
+    }
+
+    function redirectToLogin() {
+        localStorage.removeItem("token");
+        localStorage.removeItem("user");
+        if (!window.location.pathname.startsWith("/login")) {
+            window.location.href = "/login?expired=1";
+        }
+    }
+
     async function apiFetch(endpoint, options = {}) {
         const token = localStorage.getItem("token");
+        if (token && isTokenExpired(token)) {
+            redirectToLogin();
+            throw new Error("Session expired");
+        }
         const headers = {
             "Content-Type": "application/json",
             ...options.headers,
@@ -14,6 +46,10 @@ document.addEventListener("DOMContentLoaded", function () {
             ...options,
             headers,
         });
+        if (response.status === 401) {
+            redirectToLogin();
+            throw new Error("Authentication required");
+        }
         if (!response.ok) {
             let errorMsg = `HTTP ${response.status}`;
             try {
@@ -35,6 +71,8 @@ document.addEventListener("DOMContentLoaded", function () {
 
     window.LinkSync = {
         apiFetch,
+        isTokenExpired,
+        getTokenExpirySeconds,
         async getLinks(params = {}) {
             const qs = new URLSearchParams(params).toString();
             return apiFetch(`/links/?${qs}`);
@@ -72,6 +110,9 @@ document.addEventListener("DOMContentLoaded", function () {
         async deleteCollection(id) {
             return apiFetch(`/collections/${id}`, { method: "DELETE" });
         },
+        async previewQuery(expression) {
+            return apiFetch(`/queries/preview?expression=${encodeURIComponent(expression)}`);
+        },
         async executeQuery(expression, limit = 20) {
             return apiFetch(`/queries/execute?expression=${encodeURIComponent(expression)}&limit=${limit}`);
         },
@@ -95,6 +136,7 @@ document.addEventListener("DOMContentLoaded", function () {
         logout() {
             localStorage.removeItem("token");
             localStorage.removeItem("user");
+            window.location.href = "/login";
         },
         async getUsers() {
             return apiFetch("/admin/users");