- client.ts: handle 401 responses by attempting token refresh, then logout and redirect to /login on failure
- Keys.tsx: add actionError state, surface API errors from handleRename and handleFreeze with visible error banner
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>