[RA AUTH-004] Silent token-refresh failure only logs; no forced redirect to /login on expiry

## Problem

The `onTokenExpired` handler calls `updateToken()` but the `.catch` block only logs the error. When a background token refresh fails (e.g., Keycloak session expired, offline token revoked), no forced navigation to `/login` occurs. The user remains on the application UI in an authenticated-looking state with an expired, non-refreshable token.

## Impact

Users remain in an indeterminate authenticated state after session expiry. Subsequent API calls will fail silently (or return 401/403 errors) rather than presenting a clean re-authentication flow, which may confuse users and mask the root cause.

## Evidence / location

- `src/app/services/keycloak.service.ts:74-83`

## Expected

When background token refresh fails in `onTokenExpired`, redirect the user to `/login` so they can re-authenticate.

## Source

- Rapid assessment `ra-2026-07-21T171227Z` finding `AUTH-004`
- Ticket backlog: `docs/bcparks-ar-admin-rapid-assessment-tickets.md` (this repo)

Start in src/app/services/keycloak.service.ts at lines 74-83 and inspect the onTokenExpired handler and its existing navigation patterns. Verify the behavior when updateToken() fails, then confirm that the failure path sends the user to /login rather than leaving the application in an authenticated-looking state.

Written by the indexing model from the issue text.