feat(router): prevent redirection from public landing pages on session expiration

frontend/src/router/index.js

@@ -43,6 +43,12 @@ const router = createRouter({
 });
 
 router.beforeEach(async (to, from, next) => {
+  // These are public entry pages. They must never be redirected because a
+  // persisted login has expired while the application is starting up.
+  if (to.meta?.publicLanding) {
+    return next();
+  }
+
   if (to.matched.some(record => record.meta.requiresAuth)) {
     if (!store.getters.isLoggedIn) {
       return next('/');

frontend/src/store/index.js

@@ -278,13 +278,13 @@ const store = createStore({
       }
       await dispatch('loadMenu');
     },
-    logout({ commit }) {
+    logout({ commit }, { redirectToHome = true } = {}) {
       commit('clearSocket');
       commit('clearDaemonSocket');
       commit('dologout');
       // Öffentliche SEO-Landingpages müssen auch dann an ihrer URL bleiben,
       // wenn eine gespeicherte Sitzung abgelaufen ist und per 401 zurückgesetzt wird.
-      if (!router.currentRoute.value.meta?.publicLanding) {
+      if (redirectToHome && !router.currentRoute.value.meta?.publicLanding) {
         router.push('/');
       }
     },

frontend/src/utils/axios.js

@@ -32,7 +32,9 @@ apiClient.interceptors.response.use(response => {
     return response;
 }, error => {
     if (error.response && error.response.status === 401) {
-        store.dispatch('logout');
+        // A failed background request may clear a stale browser session, but
+        // it must not replace the visitor's current public landing URL.
+        store.dispatch('logout', { redirectToHome: false });
     }
     return Promise.reject(error);
 });