Must be rendered inside an <AuthProvider> and an <ApplicationStoreProvider>.

Keeps the in-memory token and cookie in sync with the OIDC provider and proactively renews the access token before it expires so that long-running sessions (e.g. Legend marketplace AI chat, query execution) never send stale credentials.