fix(ui): stop reading a credential 401 as a session expiry

[argszero]

Summary

A 401 from POST /api/auth/login means "the credentials you just sent are wrong", but ui/js/api.js read every 401 as "your session expired": it cleared the token, returned to the login page and toasted login.session.expired. Typing a wrong password therefore produced that toast on top of the inline "Incorrect email or password" — telling somebody who had never signed in that their session had expired.

The two meanings are indistinguishable in the request throat, so the caller now declares which one applies:

api.post("/api/auth/login", { email, password: pass }, { on401: api.CREDENTIAL_401 })

Anything else — including an unknown value — keeps the session-expiry reading, so a forgotten declaration fails towards "sign the user out once too often", never towards "leave a dead session standing". With the flag set the 401 falls through to the ordinary error construction and keeps status === 401, so the login form's inline error branch still fires.

POST /api/auth/change-password has the same 401 semantics (wrong old password) and the same shape would clear a still-valid token and throw the user out of the app. It has no front-end consumer today, so only the rule is recorded — no call site is invented.

Folded in (same axis): the login flow stops hand-rolling its bring-in. Once the credentials are accepted it reuses the boot entry point restoreSession(), so a token holder can no longer be stranded on the login page when the session load fails for a non-auth reason — the invariant from #244, reached through a different door (before: saveToken() followed by a failing loadSession() left a saved token sitting behind a login form, visually identical to "you were logged out").

Not a host rant: found by this task's own recon (the previous round's instrument disproved the original write-up of this defect — the inline error is reachable, the spurious toast is the real fault).

Related Issue

None — no open issue covers this.

Changes

• ui/js/api.js — add CREDENTIAL_401 and the opts.on401 guard on the 401 branch; the verbs pass opts through
• ui/js/app.js — the login call declares the endpoint's 401 semantics; bring-in goes through restoreSession()
• src/i18n_pack.rs — credential_401_is_not_a_session_expiry pins the shape in CI (the call site declares it, the throat's 401 branch is guarded by it, and the global sign-out still exists), with detector controls. The control flow itself has no JS runner in CI, so the runtime half is documented in ui/README.md
• ui/README.md — record the rule and the smoke-test shape
• ui/index.html — cache-bust api.js / app.js
• No config / schema / data-structure change, so no example file to sync

Tests

• cargo test — 258 passed, 0 failed (257 before; +1 for the new gate)
• cargo fmt --check — clean
• cargo clippy --all-targets — only the pre-existing collapsible_match suggestion at src/protocol.rs:662 (unrelated; CI runs stable clippy and is green)
• New unit test added

Runtime verification (jsdom, not in CI)

Instrument boots the real ui/index.html + the four real scripts, stubs only fetch (reproducing the backend's real answers), and drives the real login form. Four legs: login401 / login500 / boot401 / loginok.

Variant	Red assertions
origin/main (pre-fix)	login401: B1, login500: E1,E3
fixed tree	— (green)
guard removed from api.js	B1
declaration removed from the call site	B1
bring-in reverted to loadSession()+enterApp()	E1,E3
global sign-out deleted (the tempting half-fix)	C1,C3 — disjoint from the axis
inline credential error dropped	B3

Where B1 = "no login.session.expired toast after a wrong password", B3 = "the inline login.err.bad is shown instead" (positive control — already green before the fix), C1/C3 = "a business 401 still clears the token and says session-expired", E1/E3 = "credentials accepted but /api/me failing still enters the app". The pre-fix red set equals the union of the first three mutation legs. The C leg is what makes the instrument pin the direction rather than merely "a change": deleting the global sign-out turns the axis green while silently disabling sign-out everywhere else.

Checklist

• Branch name follows the convention (fix/…)
• Commit message uses Conventional Commits (fix(ui): …)
• Single responsibility, minimal diff (5 files, +149/−13; 99 of those lines are the new gate and its comments)