fix auth refresh endpoint and quiet expected 401 on profile check

frontend/src/lib/api/client.ts

@@ -26,6 +26,18 @@ function isPublicInvitationRequest(url: string | undefined): boolean {
   );
 }
 
+/** Session bootstrap / auth endpoints where 401 means "not logged in", not "retry refresh". */
+function shouldSkipRefreshRetry(url: string | undefined): boolean {
+  if (!url) return false;
+  return (
+    url.includes('/auth/profile') ||
+    url.includes('/auth/refresh') ||
+    url.includes('/auth/login') ||
+    url.includes('/auth/register') ||
+    url.includes('/auth/logout')
+  );
+}
+
 // ❌ REMOVE request interceptor completely (no Authorization header)
 
 // ✅ Response interceptor
@@ -37,7 +49,8 @@ apiClient.interceptors.response.use(
     if (
       error.response?.status === 401 &&
       !originalRequest._retry &&
-      !isPublicInvitationRequest(originalRequest.url)
+      !isPublicInvitationRequest(originalRequest.url) &&
+      !shouldSkipRefreshRetry(originalRequest.url)
     ) {
       originalRequest._retry = true;
 

frontend/src/lib/hooks/useAuth.tsx

@@ -107,8 +107,16 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
           setCurrentOrganization(null);
         }
       }
-    } catch (err) {
-      console.error('Auth check failed:', err);
+    } catch (err: unknown) {
+      const status =
+        (err as { statusCode?: number })?.statusCode ??
+        (err as { response?: { status?: number } })?.response?.status;
+
+      // 401 on profile is expected when there is no session — not an application error.
+      if (status !== 401) {
+        console.error('Auth check failed:', err);
+      }
+
       // Only clear state — DO NOT redirect here
       setUser(null);
       setOrganizations([]);