i18n(session): add missing translations

frontend/src/lib/api/client.ts

@@ -35,7 +35,10 @@ const SERVER_STATUS_HEADER = 'x-server-status';
 
 const REFRESH_ENDPOINT = '/api/auth/refresh';
 
-/** Auth primitives — a 401 here is genuine, never an expired access token. */
+/** Auth primitives — a 401 here is genuine, never an expired access token.
+ * Also used by the session-teardown gate to exempt endpoints that must
+ * still fire during / immediately after a logout (the logout POST itself,
+ * and every login path a user might retry on the /login landing). */
 const AUTH_PRIMITIVES = [
 	'/api/auth/login',
 	'/api/auth/logout',
@@ -43,7 +46,11 @@ const AUTH_PRIMITIVES = [
 	'/api/auth/register',
 	'/api/auth/setup',
 	'/api/auth/oidc/',
-	'/api/auth/device/'
+	'/api/auth/device/',
+	'/api/auth/opaque/',
+	'/api/auth/magic-link/',
+	'/api/auth/status',
+	'/api/auth/dpop/'
 ];
 
 export type FetchFn = typeof fetch;

frontend/src/lib/components/AppShell.svelte

@@ -524,7 +524,11 @@
 		// landing from `?source=session_expired` (auto-divert on 401 →
 		// refresh 401). The login page reads the flag, shows the success
 		// notice, and skips its existing-session probe.
-		await goto(resolve('/login?source=logged_out'));
+		// `resolve()` from `$app/paths` normalises a route-id (adds base
+		// path prefix); it does NOT accept a query string. Concatenate
+		// the `?source=logged_out` marker AFTER resolve so the login
+		// page's onMount branch actually sees it.
+		await goto(resolve('/login') + '?source=logged_out');
 	}
 </script>
 

frontend/src/lib/stores/session.svelte.ts

@@ -7,6 +7,7 @@
  * folder and land on the shared-with-me view.
  */
 import { bindDpopIfPossible, fetchMe, tryRefresh } from '$lib/api/endpoints/auth';
+import { setLogoutInProgress } from '$lib/api/client';
 import { drives } from '$lib/stores/drives.svelte';
 import type { User } from '$lib/api/types';
 import { ensureActiveUser } from '$lib/utils/localStoragePrefs';
@@ -77,6 +78,12 @@ class SessionStore {
 	setUser(user: User): void {
 		this.user = user;
 		ensureActiveUser(user.id);
+		// Any successful login clears the session-teardown gate. Without
+		// this, a logout → login within the same SPA session leaves the
+		// gate stuck at `true` — the login POST is exempted via
+		// `AUTH_PRIMITIVES`, but the /me + /drives + … fetches the app
+		// fires post-login would all abort with "Session terminated".
+		setLogoutInProgress(false);
 	}
 
 	/**