Description

When auth is enabled, submitting wrong credentials on the login form gave the
user no feedback: the page silently reloaded and the only trace was a 401 in the
console.

Root cause. The global 401 interceptor in apiFetch (web/lib/api.ts) redirects
to /login and returns a never-resolving promise on every 401. The login and
register requests go through apiFetch too, so a 401 from wrong credentials triggered
a full-page reload back to /login, and login() never resolved — handleSubmit
never reached setError, so no inline error was ever shown.

Fix. Add an opt-out skipAuthRedirect flag to apiFetch and pass it from the
login() and register() calls, so their 401/400 responses are returned to the
caller and rendered as inline form errors. The expired-session redirect still applies
to every other endpoint, unchanged.

Related Issues

• N/A — no existing issue; this was unreported.

Module(s) Affected

• agents
• api
• config
• core
• knowledge
• logging
• services
• tools
• utils
• web (Frontend)
• docs (Documentation)
• scripts
• tests
• Other: ...

Checklist

• I have read and followed the contribution guidelines.
• My code follows the project's coding standards.
• I have run pre-commit and fixed any issues.
• I have added relevant tests for my changes.
• I have updated the documentation (if necessary).
• My changes do not introduce any new security vulnerabilities.

Additional Notes

Behavior

After:

Tests — web/tests/api-auth-redirect.test.ts (run with npm run test:node):

• apiFetch redirects to /login on 401 by default.
• apiFetch does not redirect on 401 when skipAuthRedirect is set, and returns
  the 401 + detail to the caller — the regression guard for this bug.
• successful (200) responses pass through untouched.

Verification

• tsc clean; node test suite 3/3 pass.
• Mutation check: removing the !skipAuthRedirect guard makes the regression test
  fail as expected, confirming the test actually catches the regression.
• pre-commit run --files <changed files> — all applicable hooks pass.
• Rebuilt the Docker image and confirmed POST /api/v1/auth/login with bad credentials
  returns 401 {"detail":"Incorrect username or password"} — the text now rendered
  inline (see screenshot).