fix: make the 401 login redirect loop structurally impossible

Audit of every code path that can produce the login->/->login cycle
found the observed loop was one instance of a repeatable class: any
automatic API call that persistently 401s while the Supabase session is
valid triggers httpErrorHandler's hard redirect to /login, which sees
the valid session and bounces back. Close the class, not just the
instance:

- saas apiClient: a 401 that survives a refresh-and-retry means the
  backend rejected a valid token (authz bug / wrong origin), not an
  expired session - never redirect to /login for it. Also fix the stale
  publicEndpoints entry ('endpoints-enabled' matched nothing; the real
  routes are endpoints-availability and endpoint-enabled).
- httpErrorHandler: sessionStorage loop breaker - if a 401 redirect
  already fired within 10s, suppress the repeat instead of cycling.
- Guard the remaining unflagged automatic callers: /api/v1/credits
  (fires on session init and TOKEN_REFRESHED), endpoints-availability
  (fires on app load), and ui-data/login (auto-called when a stale
  stirling_jwt is present).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

frontend/editor/src/core/hooks/useEndpointConfig.ts

@@ -128,10 +128,16 @@ export function useMultipleEndpointsEnabled(endpoints: string[]): {
           "[useEndpointConfig] Fetching all endpoint statuses from server",
         );
 
-        // Fetch all endpoints at once - no query params needed
+        // Fetch all endpoints at once - no query params needed.
+        // Fires automatically on app load; a 401 here (e.g. backend rejecting
+        // an otherwise-valid session) must fail silently rather than reach the
+        // global handler, which hard-redirects to /login and can loop.
         const response = await apiClient.get<
           Record<string, EndpointAvailabilityDetails>
-        >(`/api/v1/config/endpoints-availability`);
+        >(`/api/v1/config/endpoints-availability`, {
+          suppressErrorToast: true,
+          skipAuthRedirect: true,
+        });
 
         // Populate global cache with all results
         Object.entries(response.data).forEach(([endpoint, details]) => {

frontend/editor/src/core/services/accountService.ts

@@ -28,8 +28,12 @@ export const accountService = {
    * This is a public endpoint - doesn't require authentication
    */
   async getLoginPageData(): Promise<LoginPageData> {
+    // Public endpoint, but also auto-called by the onboarding orchestrator
+    // when a stale stirling_jwt is in localStorage — a 401 must never trigger
+    // the global login redirect (it would loop on every page load).
     const response = await apiClient.get<LoginPageData>(
       "/api/v1/proprietary/ui-data/login",
+      { suppressErrorToast: true, skipAuthRedirect: true },
     );
     return response.data;
   },

frontend/editor/src/core/services/httpErrorHandler.ts

@@ -46,6 +46,39 @@ function stashPostLoginRedirect(path: string): void {
   }
 }
 
+// Loop breaker for the 401 hard-redirect below. If the backend persistently
+// 401s an automatic call while the auth session is actually valid, the
+// redirect lands on /login, the login page sees the valid session and bounces
+// back, the call 401s again and we redirect again — forever. sessionStorage
+// survives the full-page navigations of that cycle (per tab), so a second
+// redirect within the window means we're looping, not expiring.
+const LOGIN_REDIRECT_THROTTLE_KEY = "stirling_last_401_redirect";
+const LOGIN_REDIRECT_THROTTLE_MS = 10_000;
+
+function loginRedirectRecentlyFired(): boolean {
+  try {
+    const last = Number(
+      window.sessionStorage.getItem(LOGIN_REDIRECT_THROTTLE_KEY),
+    );
+    return (
+      Number.isFinite(last) && Date.now() - last < LOGIN_REDIRECT_THROTTLE_MS
+    );
+  } catch {
+    return false;
+  }
+}
+
+function markLoginRedirectFired(): void {
+  try {
+    window.sessionStorage.setItem(
+      LOGIN_REDIRECT_THROTTLE_KEY,
+      String(Date.now()),
+    );
+  } catch {
+    // sessionStorage unavailable — fail open
+  }
+}
+
 /**
  * Handles HTTP errors with toast notifications and file error broadcasting
  * Returns true if the error should be suppressed (deduplicated), false otherwise
@@ -71,6 +104,13 @@ export async function handleHttpError(error: any): Promise<boolean> {
 
     // If not on auth page, redirect to login with expired session message
     if (!isAuthPage && !skipAuthRedirect) {
+      if (loginRedirectRecentlyFired()) {
+        console.warn(
+          "[httpErrorHandler] 401 redirect already fired moments ago — suppressing repeat to avoid a login loop:",
+          error?.config?.url,
+        );
+        return true;
+      }
       console.debug("[httpErrorHandler] 401 detected, redirecting to login");
       // Spring 302-strips the ?from= query from /login, so stash the return
       // path in sessionStorage (AuthCallback reads it after SSO round-trip).
@@ -83,6 +123,7 @@ export async function handleHttpError(error: any): Promise<boolean> {
         // ignore storage access failures
       }
       const expiredPrefix = hadStoredJwt ? "expired=true&" : "";
+      markLoginRedirectFired();
       window.location.href = `${withBasePath("/login")}?${expiredPrefix}from=${encodeURIComponent(currentLocation)}`;
       return true; // Suppress toast since we're redirecting
     }