Redirect to login on expired/invalid auth

Backend now returns 401 instead of 403 for unauthenticated requests
via HttpStatusEntryPoint. UI middleware handles both 401 and 403,
triggering token refresh and redirecting to /login on failure.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

ui/src/api/client.ts

@@ -23,7 +23,7 @@ const authMiddleware: Middleware = {
     return request;
   },
   async onResponse({ response }) {
-    if (response.status === 401) {
+    if (response.status === 401 || response.status === 403) {
       onUnauthorized();
     }
     return response;