fix: drive logout from real 401s, not local storage changes

apiFetch now redirects to login only on a genuine backend 401 (auth endpoints excluded, only when previously logged in). AuthSyncWatcher no longer treats localStorage.clear()/unrelated writes as a logout, fixing spurious sign-outs (e.g. when uploading skills).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend-web/src/core/api/fetch-client.ts

@@ -1,4 +1,8 @@
-import { getAuthorizationHeaderValue } from "@/core/auth";
+import {
+  clearStoredAuth,
+  getAuthorizationHeaderValue,
+  getStoredAuth,
+} from "@/core/auth";
 import { withCsrfHeaders } from "./csrf";
 
 function withAuthHeaders(headers?: HeadersInit): Headers {
@@ -8,13 +12,40 @@ function withAuthHeaders(headers?: HeadersInit): Headers {
     next.set("Authorization", authHeader);
   }
   return next;
-}
-
-export function apiFetch(input: RequestInfo | URL, init?: RequestInit) {
-  return fetch(input, {
+}
+
+function requestUrl(input: RequestInfo | URL): string {
+  if (typeof input === "string") return input;
+  if (input instanceof URL) return input.href;
+  return (input as Request).url ?? "";
+}
+
+export async function apiFetch(input: RequestInfo | URL, init?: RequestInit) {
+  const response = await fetch(input, {
     ...init,
     credentials: init?.credentials ?? "include",
     headers: withAuthHeaders(init?.headers),
   });
+
+  // Session is considered lost ONLY when the backend actually answers 401.
+  // (Previously a stray localStorage change could log the user out client-side
+  // even though the session was still valid.) Auth endpoints are excluded so a
+  // failed/transient login attempt never wipes state, and we only act when we
+  // believed we were logged in — avoiding redirect loops on the login page.
+  if (response.status === 401) {
+    const url = requestUrl(input);
+    const isAuthEndpoint = url.includes("/api/v1/auth/");
+    if (!isAuthEndpoint && getStoredAuth()) {
+      clearStoredAuth();
+      if (
+        typeof window !== "undefined" &&
+        !window.location.hash.startsWith("#/login")
+      ) {
+        window.location.replace("#/login");
+      }
+    }
+  }
+
+  return response;
 }
-
+