- Add loginRedirect.ts: maybeRedirectToLogin (sessionStorage one-shot guard) and clearLoginRedirect; guards window/sessionStorage for SSR/test safety - Add loginRedirect.test.ts: covers first-call redirect, one-shot no-op, clear+retry - Update client.ts: remove false claim that fetch follows Authelia 302 automatically; note that XHR/fetch CORS-blocks cross-origin redirects, top-level nav required