fix: remove 401 hard redirect, let React Query retry

The /api/me call races with TokenSync — fires before the token
provider is set. Removed the hard window.location redirect on 401
from the API client. React Query retries with backoff instead.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

ui/src/api/client.ts

@@ -6,11 +6,6 @@ export function setTokenProvider(provider: (() => Promise<string | undefined>) |
   tokenProvider = provider;
 }
 
-let logoutHandler: (() => void) | null = null;
-
-export function setLogoutHandler(handler: (() => void) | null) {
-  logoutHandler = handler;
-}
 
 async function apiFetch<T>(path: string, options: RequestInit = {}): Promise<T> {
   const token = tokenProvider ? await tokenProvider() : null;
@@ -27,8 +22,8 @@ async function apiFetch<T>(path: string, options: RequestInit = {}): Promise<T>
   const response = await fetch(`${API_BASE}${path}`, { ...options, headers });
 
   if (response.status === 401) {
-    if (logoutHandler) logoutHandler();
-    window.location.href = '/login';
+    // Don't hard-redirect — let React Query retry (token may not be ready yet).
+    // The ProtectedRoute handles unauthenticated state.
     throw new Error('Unauthorized');
   }
 

ui/src/api/hooks.ts

@@ -190,6 +190,8 @@ export function useMe() {
     queryKey: ['me'],
     queryFn: () => api.get<MeResponse>('/me'),
     staleTime: 60_000,
+    retry: 3,
+    retryDelay: 1000,
   });
 }