feat(player): CF AI preview/swap + fix PB token expiry + local build time

- Backend: add GET /api/audio-preview/{slug}/{n} — generates first ~1800-char
  chunk via CF AI so playback starts immediately; full chapter cached in MinIO
- Frontend: replace CF AI spinner with preview blob URL + background swap to
  full presigned URL when runner finishes, preserving currentTime
- AudioPlayer: isPreview state + 'preview' badge in mini-bar during swap
- pocketbase.ts: fix 403 on stale token — reduce TTL to 50 min + retry once
  on 401/403 with forced re-auth (was cached 12 h, PB tokens expire in 1 h)
- Footer build time now rendered in user's local timezone via toLocaleString()

ui/src/lib/server/pocketbase.ts

@@ -100,8 +100,8 @@ export interface User {
 let _token = '';
 let _tokenExp = 0;
 
-async function getToken(): Promise<string> {
-	if (_token && Date.now() < _tokenExp) return _token;
+async function getToken(forceRefresh = false): Promise<string> {
+	if (!forceRefresh && _token && Date.now() < _tokenExp) return _token;
 
 	log.debug('pocketbase', 'authenticating with admin credentials', { url: PB_URL, email: PB_EMAIL });
 
@@ -119,7 +119,9 @@ async function getToken(): Promise<string> {
 
 	const data = await res.json();
 	_token = data.token as string;
-	_tokenExp = Date.now() + 12 * 60 * 60 * 1000; // 12 hours
+	// PocketBase superuser tokens expire in ~1 hour by default.
+	// Cache for 50 minutes to stay safely within that window.
+	_tokenExp = Date.now() + 50 * 60 * 1000;
 	log.info('pocketbase', 'admin auth token refreshed', { url: PB_URL });
 	return _token;
 }
@@ -132,6 +134,18 @@ async function pbGet<T>(path: string): Promise<T> {
 		headers: { Authorization: `Bearer ${token}` }
 	});
 	if (!res.ok) {
+		// On 401/403, the token may have expired on the PocketBase side even if
+		// our local TTL hasn't fired yet. Force a refresh and retry once.
+		if (res.status === 401 || res.status === 403) {
+			const freshToken = await getToken(true);
+			const retry = await fetch(`${PB_URL}${path}`, {
+				headers: { Authorization: `Bearer ${freshToken}` }
+			});
+			if (retry.ok) return retry.json() as Promise<T>;
+			const retryBody = await retry.text().catch(() => '');
+			log.error('pocketbase', 'GET failed', { path, status: retry.status, body: retryBody });
+			throw new Error(`PocketBase GET ${path} failed: ${retry.status} — ${retryBody}`);
+		}
 		const body = await res.text().catch(() => '');
 		log.error('pocketbase', 'GET failed', { path, status: res.status, body });
 		throw new Error(`PocketBase GET ${path} failed: ${res.status} — ${body}`);