Preserve destination on session-expiry login; compact the tokens table

The 401 interceptor (session expired) redirected to bare /login,
losing the page the user was on - the router guard already preserved
it but the expiry path bypassed the guard. The interceptor now carries
?redirect= like the guard does, and Login returns there.

The API tokens tables overflowed the card: the token column no longer
repeats the shopdb_pat_ prefix per row (short prefix shown, full form
on hover) - the token itself was already never displayed after
creation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

frontend/src/api/index.js

@@ -28,9 +28,14 @@ api.interceptors.response.use(
       const hadToken = localStorage.getItem('token')
       localStorage.removeItem('token')
       localStorage.removeItem('user')
-      // Only redirect if user was previously logged in (session expired)
+      // Only redirect if user was previously logged in (session expired).
+      // Preserve the destination so login returns the user to this page.
       if (hadToken) {
-        window.location.href = '/login'
+        const here = window.location.pathname + window.location.search
+        const target = here && here !== '/login'
+          ? '/login?redirect=' + encodeURIComponent(here)
+          : '/login'
+        window.location.href = target
       }
     }
     return Promise.reject(error)