[Refactor] Collect requested token IDs declaratively in validateSession

[github-actions]

WHY are these changes introduced?

validateSession decided whether any requested token was expired using four
near-identical if blocks, each re-deriving an application ID and then
re-assigning a shared tokensAreExpired accumulator. The repetition made it
hard to see at a glance which applications are checked, and adding a new
application meant copying the block a fifth time.

WHAT is this pull request doing?

Collect the requested application token IDs into a single list and check them
with Array.prototype.some, so the expiry check reads as one expression
instead of four mutations of a shared variable. businessPlatformApi remains
unchecked, exactly as before.

Behavior is unchanged: isTokenExpired is pure and the original || chain
already short-circuited, so .some() evaluates the same tokens to the same
result.

How to manually test your changes?

CI

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch for bug fixes · minor for new features · major for breaking changes) and added a changeset with pnpm changeset add