Updated A LOT

src/services/api.js

@@ -9,6 +9,11 @@ export async function apiRequest(path, token, options = {}) {
   });
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
+    // An invalid/expired token (401) means the session is no longer valid — signal the
+    // app to drop back to the login screen. (403 is a role/permission denial, not a session issue.)
+    if (response.status === 401) {
+      window.dispatchEvent(new CustomEvent('mixedassets:unauthorized'));
+    }
     throw new Error(body.error || `Request failed: ${response.status}`);
   }
   return response;