Backend now returns 401 instead of 403 for unauthenticated requests via HttpStatusEntryPoint. UI middleware handles both 401 and 403, triggering token refresh and redirecting to /login on failure. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>