Don't force a login redirect on 401 from auth endpoints.

The response interceptor treated every 401 as an expired session and
redirected to /login. For the login/register/refresh requests themselves
a 401 just means bad credentials, so the redirect reloaded the page and
discarded the error toast. Skip the refresh/redirect path for auth
endpoints so the form can show its error.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -26,7 +26,16 @@ api.interceptors.response.use(
   async (error) => {
     const originalRequest = error.config;
 
-    if (error.response?.status === 401 && !originalRequest._retry) {
+    // Auth endpoints handle their own 401s (e.g. wrong credentials on the login
+    // form). Refreshing/redirecting here would reload the page and discard the
+    // error toast the caller is about to show.
+    const requestUrl: string = originalRequest?.url || '';
+    const isAuthEndpoint =
+      requestUrl.includes('/auth/login') ||
+      requestUrl.includes('/auth/register') ||
+      requestUrl.includes('/auth/refresh');
+
+    if (error.response?.status === 401 && !originalRequest._retry && !isAuthEndpoint) {
       originalRequest._retry = true;
 
       try {