Warn before the idle-timeout logs a user out mid-form

Session timeout (30 min) only resets on a real PHP page load, but the
Location QR type's address search runs entirely client-side against
Nominatim, so a slow fill-in can silently expire the session and bounce
the user back to login, losing the form. Adds a toast that appears a
couple of minutes before expiry with a "stay logged in" button that
pings session_ping.php to refresh last_activity without navigating away.

src/session_ping.php

@@ -0,0 +1,18 @@
+<?php
+// Lightweight keep-alive endpoint: including bootstrap.php refreshes
+// $_SESSION['last_activity'], extending the idle timeout without navigating
+// away from (and losing) whatever form the user is currently filling in.
+// Deliberately doesn't use auth_validate.php's redirect-to-login-on-failure
+// behavior: this is called from JS, and a 401 lets the caller show "your
+// session already expired" instead of silently following a redirect.
+require_once 'includes/bootstrap.php';
+
+header('Content-Type: application/json');
+
+if (empty($_SESSION['user_logged_in'])) {
+    http_response_code(401);
+    echo json_encode(['ok' => false]);
+    exit;
+}
+
+echo json_encode(['ok' => true]);