No session expiry or idle timeout in Flutter auth module - stolen device gives permanent authenticated access

## Problem

The Flutter auth module (`lib/screens/auth/`) uses Supabase session tokens
that persist indefinitely in device storage. There is no idle timeout, no
session expiry configuration, and no mechanism to force re-authentication
after a period of inactivity.

For a productivity app handling work tasks, tickets, and meeting transcriptions,
a stolen or unlocked device gives the thief permanent, unrevocable access to
all of a user's project data. The user has no way to remotely invalidate the
session from another device unless the Supabase admin manually revokes tokens.

## Impact

- A stolen phone or an unattended unlocked screen gives full access to the
user's tasks, tickets, and meeting recordings indefinitely.
- No in-app session revocation mechanism exists for users to protect themselves.

## Suggested Fix

1. Configure Supabase Auth session settings to enforce a reasonable access
token lifetime (e.g. 1 hour) and refresh token rotation.
2. Implement an idle detection timer in the Flutter app that signs the user
out after a configurable period of inactivity (e.g. 30 minutes).
3. Add a "Sign out all devices" option in the profile screen that calls
`supabase.auth.signOut(scope: SignOutScope.global)` to revoke all active
sessions.
4. Store session tokens using Flutter's `flutter_secure_storage` package
(which uses the platform keychain/keystore) rather than plain shared
preferences.

Start by tracing the auth flow under lib/screens/auth/ and locating the profile screen, Supabase session configuration, and current device-storage path. Map where inactivity can be observed and where sign-out is handled; done means the issue's four protections are implemented, including global sign-out and secure token storage, with configurable expiry and idle behavior.

由索引模型根據 Issue 內容生成。