fix: stop infinite page reload caused by premature NodeProvider mount and 401 hard-redirect

- Move NodeProvider inside the authenticated branch in App.tsx so it only
  mounts after auth is confirmed; previously it mounted on boot causing
  refreshNodes to fire before any session existed
- Replace window.location.href='/' on 401 in apiFetch with a
  sencho-unauthorized custom event; AuthContext listens and transitions
  appStatus to notAuthenticated without a full browser reload

frontend/src/App.tsx

@@ -31,7 +31,11 @@ function AppContent() {
     );
   }
 
-  return <EditorLayout />;
+  return (
+    <NodeProvider>
+      <EditorLayout />
+    </NodeProvider>
+  );
 }
 
 import { Toaster } from 'sonner';
@@ -39,10 +43,8 @@ import { Toaster } from 'sonner';
 function App() {
   return (
     <AuthProvider>
-      <NodeProvider>
-        <AppContent />
-        <Toaster position="bottom-right" richColors />
-      </NodeProvider>
+      <AppContent />
+      <Toaster position="bottom-right" richColors />
     </AuthProvider>
   );
 }

frontend/src/context/AuthContext.tsx

@@ -47,6 +47,9 @@ export function AuthProvider({ children }: { children: ReactNode }) {
 
   useEffect(() => {
     checkAuth();
+    const handleUnauthorized = () => setAppStatus('notAuthenticated');
+    window.addEventListener('sencho-unauthorized', handleUnauthorized);
+    return () => window.removeEventListener('sencho-unauthorized', handleUnauthorized);
   }, []);
 
   const login = async (username: string, password: string): Promise<{ success: boolean; error?: string }> => {

frontend/src/lib/api.ts

@@ -19,8 +19,8 @@ export async function apiFetch(
   const response = await fetch(url, { ...defaultOptions, ...options });
 
   if (response.status === 401) {
-    // Clear auth state and redirect to login
-    window.location.href = '/';
+    // Signal auth failure to AuthContext without a hard page reload
+    window.dispatchEvent(new Event('sencho-unauthorized'));
     throw new Error('Unauthorized');
   }