fix: make the 401 login redirect loop structurally impossible

Audit of every code path that can produce the login->/->login cycle
found the observed loop was one instance of a repeatable class: any
automatic API call that persistently 401s while the Supabase session is
valid triggers httpErrorHandler's hard redirect to /login, which sees
the valid session and bounces back. Close the class, not just the
instance:

- saas apiClient: a 401 that survives a refresh-and-retry means the
  backend rejected a valid token (authz bug / wrong origin), not an
  expired session - never redirect to /login for it. Also fix the stale
  publicEndpoints entry ('endpoints-enabled' matched nothing; the real
  routes are endpoints-availability and endpoint-enabled).
- httpErrorHandler: sessionStorage loop breaker - if a 401 redirect
  already fired within 10s, suppress the repeat instead of cycling.
- Guard the remaining unflagged automatic callers: /api/v1/credits
  (fires on session init and TOKEN_REFRESHED), endpoints-availability
  (fires on app load), and ui-data/login (auto-called when a stale
  stirling_jwt is present).

Co-Authored-By: Claude Opus 4.8 <[email protected]>

frontend/editor/src/saas/auth/UseSession.tsx

@@ -161,7 +161,14 @@ export function AuthProvider({ children }: { children: ReactNode }) {
           "[Auth Debug] Fetching credits for user:",
           currentSession.user.id,
         );
-        const response = await apiClient.get<ApiCredits>("/api/v1/credits");
+        // Fired automatically on session init and TOKEN_REFRESHED. If the
+        // backend rejects it (deploy skew, authz bug) the failure must stay
+        // local — the global 401 handler would hard-redirect to /login and,
+        // with a valid session, loop login -> / -> login forever.
+        const response = await apiClient.get<ApiCredits>("/api/v1/credits", {
+          suppressErrorToast: true,
+          skipAuthRedirect: true,
+        });
         const apiCredits = response.data;
 
         // Map server payload to app CreditSummary