fix: stop infinite page reload caused by premature NodeProvider mount and 401 hard-redirect

- Move NodeProvider inside the authenticated branch in App.tsx so it only
  mounts after auth is confirmed; previously it mounted on boot causing
  refreshNodes to fire before any session existed
- Replace window.location.href='/' on 401 in apiFetch with a
  sencho-unauthorized custom event; AuthContext listens and transitions
  appStatus to notAuthenticated without a full browser reload

frontend/src/lib/api.ts

@@ -19,8 +19,8 @@ export async function apiFetch(
   const response = await fetch(url, { ...defaultOptions, ...options });
 
   if (response.status === 401) {
-    // Clear auth state and redirect to login
-    window.location.href = '/';
+    // Signal auth failure to AuthContext without a hard page reload
+    window.dispatchEvent(new Event('sencho-unauthorized'));
     throw new Error('Unauthorized');
   }