Rough edges: mobile 100dvh, session-expiry in chat, sticky error toasts, journal date filter (#85)

The safe, self-contained wins from the #85 bundle:

- **Mobile viewport.** The editor used `100vh`, which on mobile Safari/Chrome is
  the LARGEST viewport (URL bar hidden), so with the bar visible the canvas
  bottom and Fit button were pushed under the browser chrome. `100dvh` fixes it.
- **Session expiry mid-chat.** A 401 during a chat turn was mapped to "the
  assistant is not available right now" — sending the user to debug a config
  problem that isn't there. Now it says the session expired and redirects to
  /login, preserving the path, like the rest of the app treats 401.
- **Error toasts persist.** Error toasts were the primary report that a mutation
  failed, yet auto-dismissed at 4s with no way to retrieve them — look away and
  it's gone. Errors now stay until dismissed; info toasts still time out; both
  get a close button.
- **Journal date filter.** `from`/`to` existed in the API and JournalFilter but
  had no UI, so "show me last spring" was unreachable. Added two date inputs
  (with a Clear) that feed the existing filter. No backend change.

Deferred to their own follow-ups (too big for this bundle, or need a decision):
revision-history retention/pruning, the agent toolbox's missing corrective tools,
plop-level journal entries from the UI, and the editor's max-width cap (a layout
call worth confirming rather than changing blind). The DESIGN.md API-listing
drift the issue mentioned was already fixed in #89.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

web/src/lib/agent.ts

@@ -160,6 +160,15 @@ export async function streamChat(
     handlers.onError('Could not reach the server.')
     return
   }
+  if (res.status === 401) {
+    // Session expired mid-conversation (#85). Reporting this as "the assistant is
+    // unavailable" would send the user chasing a config problem that isn't there.
+    // Send them to sign in again, preserving where they were.
+    handlers.onError('Your session has expired — please sign in again.')
+    const back = encodeURIComponent(location.pathname + location.search)
+    window.location.assign(`/login?redirect=${back}`)
+    return
+  }
   if (!res.ok || !res.body) {
     // 503 is the assistant being turned off at runtime (#79) — the route exists,
     // there's just no model behind it. Distinct from a 404, which would mean the