fix(#688): route expired auth sessions to sign-in (#689)

* fix(#688): route expired auth sessions to sign-in

Adopt global 401 latch, WS disconnect, and Back/profile guards.

* chore: clean up formatting noise

* fix(ktlint): reorder imports to place java and kotlinx at end

* fix(ktlint): place java.io.IOException at end of imports

* test: fix NavBackStack type parameter in AuthenticationRoutingTest

* test: add AuthSessionState tests to AuthLoginViewModelTest

* fix(ktlint): fix import order in AuthLoginViewModelTest

app/src/main/java/com/m57/hermescontrol/NavigationController.kt

@@ -2,6 +2,7 @@ package com.m57.hermescontrol
 
 import androidx.navigation3.runtime.NavBackStack
 import androidx.navigation3.runtime.NavKey
+import com.m57.hermescontrol.data.local.AuthSessionState
 
 /**
  * Central navigation controller with deduplication guard.
@@ -58,11 +59,24 @@ object NavigationController {
      */
     fun goBack(fallback: NavKey = ChatScreen) {
         val stack = backStack ?: return
+        val effectiveFallback =
+            if (AuthSessionState.signInRequired.value && (fallback == ChatScreen || isPrimaryScreen(fallback))) {
+                LandingScreen
+            } else {
+                fallback
+            }
         if (stack.size > 1) {
             stack.removeLastOrNull()
+            if (AuthSessionState.signInRequired.value &&
+                stack.lastOrNull() != AuthLoginScreen &&
+                stack.lastOrNull() != LandingScreen
+            ) {
+                stack.clear()
+                stack.add(LandingScreen)
+            }
         } else if (stack.size == 1) {
             stack.clear()
-            stack.add(fallback)
+            stack.add(effectiveFallback)
         }
     }
 }