NUL-217: Wire session-expired listener into AuthGuard (NUL-50.4) - #2

NUL-217 — Audit and complete the repo-derived frontend authentication flow

Audit result

The plan-named files (src/features/auth/*, src/store/tenant-store.ts, src/lib/api/http-client.ts, src/components/layout/topbar.tsx, src/routes/__root.tsx) are all present and well-structured on main. The gap was a single missing wire: nothing was listening for the ipam:session-expired event that apiFetch was already dispatching on non-login /api/** 401 responses (NUL-50.4).

A stale-token mutation would leave the user on a protected page indefinitely until the next manual navigation re-triggered the route guard's /me query. That breaks the "Non-login /api/** 401 clears session and preserves destination" acceptance criterion.

Changes

Auth — NUL-50.4 listener (the actual gap)

• src/features/auth/route-guard-logic.ts — added two pure functions:
  • decideSessionExpiredRedirect(currentPath, currentSearch) — sanitises the preserved from and short-circuits when the user is already on /login.
  • makeSessionExpiredHandler({ currentPath, currentSearch, queryClient, navigate, onNoOp }) — clears the ['me'] cache (remove + invalidate) and navigates to /login?from=<from>, returning a callable handler.
• src/features/auth/route-guard.tsx — useEffect subscribes to SESSION_EXPIRED_EVENT and wires the handler in. The cache is wiped before navigation so decideRedirect sees an anonymous viewer on the next render.
• src/features/auth/route-guard.test.ts — 10 new tests pinning the decision contract and the cache-clear → navigate ordering.
• scripts/_route-guard-shim.mjs + two new test mocks (scripts/_test-mocks/http-client.mjs, scripts/_test-mocks/react-query.mjs) so the existing component tests still pass with the new useQueryClient / http-client imports.

Test runner fix (NUL-217 audit)

scripts/_run-tests.mjs had two latent bugs that meant npm test ran nothing:

1. node --test does not understand **, so the default glob src/**/*.test.ts was a literal non-existent file and the runner bailed out with Could not find ....
2. The wrapper was missing the --test flag, so even when the glob was resolved the args loaded as a script.

Both fixed: the wrapper now expands ** itself via a small recursive walk and emits --test alongside --import tsx. Verified end-to-end:

npm test            # 139 passed, 0 failed
npm run typecheck   # clean
npm run build       # clean

Acceptance criteria — verified

Out of scope (per NUL-217 plan)

• No backend / cookie / schema / RBAC changes.
• No bearer tokens, SSO, reset / verification, provisioning, migrations.
• Demonstrated contract gaps (none found in this audit) would be a separate Kernel child — none filed here.

Risk + handoff

Auth-touching / Block. Sentinel review and explicit founder override are required before Relay merges this. Next: local smoke, then Sentinel review.

Evidence

• Repo-derived paths exist on main and pass their existing tests (38 → 48 auth tests after this PR; 1 → 1 tenant-store test).
• Branch: feat/nul-217-auth-flow.
• Commit: 1b7784f.