fix: Bug - User login status showing as both logged in and logged out

Stop treating transient auth_required as home-session expiry, keep auth scope
consistent across login redirect and server-rail joins, and leave /login when
the in-memory user is still authenticated.

Co-authored-by: Cursor <cursoragent@cursor.com>

toju-app/src/app/domains/authentication/application/services/signal-server-authorize.service.ts

@@ -7,6 +7,7 @@ import { ServerDirectoryFacade } from '../../../server-directory';
 import { AUTH_MODE_AUTHORIZE, buildLoginReturnQueryParams } from '../../domain/logic/auth-navigation.rules';
 import { isEndpointOnlineForConnection } from '../../../server-directory/domain/logic/server-endpoint-connectivity.rules';
 import { shouldNavigateToAuthorizeSignalServer } from '../../domain/logic/signal-server-authorize.rules';
+import { isSameSignalServerUrl } from '../../domain/logic/signal-server-auth-failure.rules';
 import { SignalServerAuthService } from './signal-server-auth.service';
 
 @Injectable({ providedIn: 'root' })
@@ -27,6 +28,16 @@ export class SignalServerAuthorizeService {
       return false;
     }
 
+    if (isSameSignalServerUrl(serverUrl, currentUser.homeSignalServerUrl)) {
+      // The home account is never auto-provisioned or re-authorized as a
+      // foreign account. Resurrect the credential from the legacy token store
+      // (session-restore case); a genuinely missing home session is handled by
+      // the session-expiry flow, not the authorize login page.
+      this.signalServerAuth.migrateHomeCredential(currentUser);
+
+      return this.signalServerAuth.hasValidCredential(serverUrl);
+    }
+
     let result;
 
     try {