fix(api): only clear session on 401 for token-bearing requests, not background calls (#10750 A12)

[mrveiss]

Thinking Path

The user-frontend ApiClient logged the user out + redirected to /login on any 401 (except /auth/ endpoints). Load-time optional probes — the telemetry-consent check (/api/settings/telemetry) and version poll (/api/services/version) — fire before/without a valid session context and can 401. Those 401s are not a rejection of the user's session (no token was sent), yet they triggered the destructive clear+redirect, spuriously nuking a valid session (session-stability bug, umbrella A12).

Root cause: rawRequest() attaches the bearer token conditionally (_getAuthToken() → only sets Authorization when a non-expired token exists), but the 401 branch ignored whether a token was actually attached. A token-less request that 401s has no session to invalidate.

What Changed

autobot-frontend/src/utils/ApiClient.ts:

• The 401 branch in rawRequest() now passes authToken != null (whether this specific request carried an Authorization: Bearer header) into _handleUnauthorized(endpoint, tokenWasAttached).
• _handleUnauthorized gained a tokenWasAttached param. When false, it logs at debug level and returns early — no localStorage clear, no Pinia logout, no redirect.
• Preserved: the existing /auth/ skip; and for a genuinely authenticated request whose token is expired/invalid (tokenWasAttached === true), the full clear+redirect still fires (feat: Enable user authentication on autobot-user-frontend #827 / fix(auth): 401 loop from stale single_user localStorage in single_company mode #972 intent).

No allowlist was added — the token-attached gate alone fully covers the background/optional-probe case, so an endpoint allowlist would be redundant surface area.

Verification

• npx vue-tsc --noEmit -p tsconfig.app.json: 0 errors in ApiClient.ts. The only remaining errors (4) are all in src/types/generated/api.ts (pre-existing base, tracked as vue-tsc-baseline red on Dev_new_gui: 6 pre-existing TS errors (config.apiUrl + stale generated api.ts) #10776) — this change adds none.
• npx eslint src/utils/ApiClient.ts: clean (exit 0, 0 warnings).
• node_modules symlinked from the main checkout to run the checks, removed before commit (only ApiClient.ts is in the diff).

Model Used

Opus 4.8 (1M context)

Part of #10750 (A12)

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!