Mechanism to detect if you've been logged out, prompt you to re-enter your password

Since API tokens expire after 14 days, it's possible to be "logged out" while the client is open. You stop having permission to do things and stop getting non-public data, but the client still thinks it's logged in. We should detect if this has happened and get the client to prompt for a password so it can get a new token. (related to flarum/framework#219)

What needs to be done:
- In Flarum\Api\LoginWithHeader, if an invalid token is presented, we should return a 401 or 403 + error message.
- The client's `app.request` method should look for this specific error. If encountered, it should present a modal to the user asking them to re-enter their password. The modal should contain the username + avatar, a password input, a "login" button, and a "cancel" button.
- If the login button is clicked, it should attempt to get a new token from the API. If successful, dismiss the modal and carry on.
- If the cancel button is clicked, it should unset app.session.user and dismiss the modal.

Read Flarum\Api\LoginWithHeader and the client's app.request entry point first, then review the related flarum/framework#219 issue. Done means invalid tokens produce the specified response, the client shows the username/avatar password modal, successful re-login resumes the request, and cancellation clears app.session.user.

Written by the indexing model from the issue text.