fix(auth): redirect unauthorized page requests

[JustinShetty]

Instead of printing the 401 error's JSON when accessing an unauthorized page (e.g. /results/21 without an active session)

This updates the auth handler to distinguish between page navigation (HTML request) and API requests.

• Unauthorized API requests get a 401 error.
• Unauthorizedpage naviation gets a 302 redirect back to /login

This PR also adds a test to cover the API vs page navigation logic.

---

Summary by cubic

Redirects unauthorized page navigation to /login instead of showing the 401 JSON error, while API requests still get 401 responses.

• Adds an isHtmlPageRequest helper that detects HTML navigation via GET/HEAD requests whose accept header includes text/html (case-insensitive).
• Clears an invalid session cookie before redirecting.
• Adds tests covering page navigation and API request detection.

^{Written for commit bbd2f21. Summary will update on new commits.}

[JustinShetty]

Happy to hear out other approaches here, this just felt like the minimal change required to improve the typical user's experience

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>