Perhaps, reversing the situation by lowering the timeout could help in finding where the root of the issue is.
Try by setting timeout as 1 minute for example for the tm1web. Open another tab then go back into that tab where the tm1-ui-web component is - did it throw the timeout notification?
One angle we can look for is which of the timeouts may not be working. Had just tried with Canvas via web.xml and setting it to 1 minute is doing that exactly. So Canvas’ timeout should be working alright.
It could be the tm1web’s URL API having a separate setting for the session timeout which the tm1web_config.xml may not have included it for - and you may need to adjust it directly with web.xml.
Hope this helps.