Let me start by thanking people in the community here who've been extremely helpful so far. I have one more odd question: is there an alternative to using the Auth Login button to trigger a custom auth resource?
The reason I ask is Xero is very pernicketty on styling and insists all apps use their own button image as the button that triggers the the authentication login: Branding and Naming — Xero Developer (named "best practice", but if you don't follow it, they won't authorize your app).
Let me see if there is a way to trigger the 're-auth' button, I don't believe there is.
However, the best work around would be to trigger the query programmatically which will re-auth if the auth token is expired/the query returns anything that isn't a 200!
This can be done with having the button trigger a script that runs something like query1.trigger() but it seems that the Auth Login button is the primary way to test and use a specific auth setup. I found these docs on the subject as it will automatically re-auth users after a certain amount of time but I don't think we expose the API that the Auth Login button triggers.