Refresh Swagger authentication before API requests

[krowvin]

Important

Merge and release Groundwork Water PR #309 first. Before merging this PR, update @usace-watermanagement/groundwork-water in cda-gui/package.json and cda-gui/package-lock.json to the actual published version containing getValidToken, then rerun the validation below.

Summary

• Refresh the Groundwork-managed token immediately before each Swagger API request.
• Make Groundwork the single owner of OIDC and AAA authentication state.
• Remove Swagger's duplicate OIDC/AAA authorization controls while preserving API-key authorization.
• Remove the confusing detached Reauthenticate action.
• Retain a backward-compatible refresh fallback until this PR is updated to the newly published Groundwork version.

Why

CDA instantiates the Groundwork auth method directly rather than through AuthProvider, so Groundwork's polling refresh was not running. Swagger's request interceptor could therefore read a stale token. Swagger UI and Groundwork also maintained parallel OIDC state, which exposed authentication controls disconnected from one another.

Related Issue

N/A

Validation

• CDA GUI ESLint passed.
• CDA GUI production build passed against the locally linked Groundwork change.
• Real local CDA/Keycloak integration using the configured 300-second access-token lifespan:
  • Initial secured Swagger request returned HTTP 200.
  • After more than six minutes idle, another Execute refreshed authentication and returned HTTP 200 without reauthentication.
  • No browser errors occurred.

Checklist

• AI tools used
• Groundwork Water PR location levels level-id-mask not allowing wild card #309 has been merged and released.
• CDA's Groundwork dependency and lockfile have been updated to that published version.
• Validation has been rerun against the published package.

[krowvin]

Initially i had left all parts of the locks in, but this is a bit of both worlds. You can use the API key still via the authorization otherwise the GWW auth methods are used.

Prior to this PR you could authenticate via the authenticate button and that was a separate swagger login to the groundwork water authmethod.