fix(#688): route expired auth sessions to sign-in (#689)

* fix(#688): route expired auth sessions to sign-in

Adopt global 401 latch, WS disconnect, and Back/profile guards.

* chore: clean up formatting noise

* fix(ktlint): reorder imports to place java and kotlinx at end

* fix(ktlint): place java.io.IOException at end of imports

* test: fix NavBackStack type parameter in AuthenticationRoutingTest

* test: add AuthSessionState tests to AuthLoginViewModelTest

* fix(ktlint): fix import order in AuthLoginViewModelTest

app/src/test/java/com/m57/hermescontrol/data/remote/NetworkResultTest.kt

@@ -1,9 +1,11 @@
 package com.m57.hermescontrol.data.remote
 
+import com.m57.hermescontrol.data.local.AuthSessionState
 import kotlinx.coroutines.runBlocking
 import okhttp3.MediaType.Companion.toMediaTypeOrNull
 import okhttp3.ResponseBody.Companion.toResponseBody
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 import retrofit2.Response
@@ -196,4 +198,36 @@ class NetworkResultTest {
             assertTrue(unknownError.message.contains("Unexpected error"))
             assertEquals(1, callCount) // Should not retry for unknown exceptions
         }
+
+    @Test
+    fun testSafeApiCall_authExpired_triggersLatchWhenReportTrue() =
+        runBlocking {
+            AuthSessionState.resetForTest()
+            assertFalse(AuthSessionState.signInRequired.value)
+
+            val result =
+                safeApiCall<String>(reportAuthExpiry = true) {
+                    Response.error(401, "Unauthorized".toResponseBody("text/plain".toMediaTypeOrNull()))
+                }
+
+            assertTrue(result is NetworkResult.Failure)
+            assertTrue((result as NetworkResult.Failure).error is NetworkError.AuthExpired)
+            assertTrue(AuthSessionState.signInRequired.value)
+        }
+
+    @Test
+    fun testSafeApiCall_authExpired_doesNotTriggerLatchWhenReportFalse() =
+        runBlocking {
+            AuthSessionState.resetForTest()
+            assertFalse(AuthSessionState.signInRequired.value)
+
+            val result =
+                safeApiCall<String>(reportAuthExpiry = false) {
+                    Response.error(401, "Unauthorized".toResponseBody("text/plain".toMediaTypeOrNull()))
+                }
+
+            assertTrue(result is NetworkResult.Failure)
+            assertTrue((result as NetworkResult.Failure).error is NetworkError.AuthExpired)
+            assertFalse(AuthSessionState.signInRequired.value)
+        }
 }