fix(core): redirect to login when auth token expires during session

When a session token expired while the user was idle, API calls returned
401 but the frontend silently showed an empty issues list instead of
redirecting to login. Two changes:

1. onUnauthorized now clears auth store state and calls onLogout, so
   DashboardGuard detects the missing user and redirects to login.
2. QueryClient no longer retries 401 errors (pointless when auth is gone).

Closes #951

packages/core/platform/core-provider.tsx

@@ -34,6 +34,10 @@ function initCore(
     onUnauthorized: () => {
       storage.removeItem("multica_token");
       storage.removeItem("multica_workspace_id");
+      // Clear auth state so DashboardGuard redirects to login.
+      // `authStore` is always initialized before any API call can fire.
+      authStore?.setState({ user: null });
+      onLogout?.();
     },
   });
   setApiInstance(api);

packages/core/query-client.ts

@@ -1,4 +1,5 @@
 import { QueryClient } from "@tanstack/react-query";
+import { ApiError } from "./api/client";
 
 export function createQueryClient(): QueryClient {
   return new QueryClient({
@@ -8,7 +9,11 @@ export function createQueryClient(): QueryClient {
         gcTime: 10 * 60 * 1000, // 10 minutes
         refetchOnWindowFocus: false,
         refetchOnReconnect: true,
-        retry: 1,
+        retry: (failureCount, error) => {
+          // Don't retry auth failures — the user needs to re-login.
+          if (error instanceof ApiError && error.status === 401) return false;
+          return failureCount < 1;
+        },
       },
       mutations: {
         retry: false,