Bug: POST /api/auth/refresh-token returning 401 resets browser Basic Auth credentials

First of all, thank you for the great work on LeafWiki, the new proxy auth feature will be a fantastic addition for us!

Problem

When LeafWiki runs with PUBLIC_ACCESS=true behind a Basic Auth reverse proxy (e.g. Traefik basicAuth middleware), the browser continuously re-prompts for credentials.

The frontend unconditionally calls POST /api/auth/refresh-token on load, even with no active session. LeafWiki returns 401, which the browser interprets as a failed Basic Auth challenge and discards the cached credentials. (https://www.rfc-editor.org/rfc/rfc9110#name-401-unauthorized, second paragraph)

Context

Relevant for the upcoming --enable-http-remote-user feature, a natural deployment pattern would be:

• Internal: Traefik forwardAuth → forwards X-Forwarded-User → users auto-logged in via proxy auth
• External: Traefik basicAuth → same LeafWiki instance with PUBLIC_ACCESS=true for read-only access

This bug makes the external ingress part of that setup non-functional.

Expected behaviour

• POST /api/auth/refresh-token with no active session should not return 401. A 400/422 would avoid triggering the browser Basic Auth reset
• OR the frontend could skip the call entirely when the user is not logged in.

Environment

• LeafWiki v0.9.2
• LEAFWIKI_PUBLIC_ACCESS=true
• Traefik v3 basicAuth middleware with removeHeader: true