fix(auth): secure sessions and app routing

Validate sessions against the API, honor configurable base paths, and route unknown pages to 404. Keep development ports stable so user and admin apps cannot be confused.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/services/http.ts

@@ -112,6 +112,22 @@ export async function apiRequest<T>(path: string, options: RequestOptions = {}):
   }
 
   if (!res.ok) {
+    if (res.status === 401 && options.auth !== false) {
+      setAccessToken(null)
+      localStorage.removeItem('fabric-admin-session')
+      sessionStorage.removeItem('fabric-admin-session')
+      const loginPath = `${import.meta.env.BASE_URL}login`
+      if (typeof window !== 'undefined' && window.location.pathname !== loginPath) {
+        const basePath = import.meta.env.BASE_URL.replace(/\/$/, '')
+        const routePath = window.location.pathname.startsWith(basePath)
+          ? window.location.pathname.slice(basePath.length) || '/'
+          : window.location.pathname
+        const redirect = encodeURIComponent(
+          `${routePath}${window.location.search}`,
+        )
+        window.location.assign(`${loginPath}?redirect=${redirect}`)
+      }
+    }
     throw new ApiError(res.status, errorMessageFromBody(data, res.status))
   }