fix: Bug - User login status showing as both logged in and logged out

Stop treating transient auth_required as home-session expiry, keep auth scope
consistent across login redirect and server-rail joins, and leave /login when
the in-memory user is still authenticated.

Co-authored-by: Cursor <cursoragent@cursor.com>

toju-app/src/app/domains/authentication/domain/logic/auth-navigation.rules.spec.ts

@@ -9,6 +9,7 @@ import { UsersActions } from '../../../../store/users/users.actions';
 import {
   buildLoginReturnQueryParams,
   resolveSafeReturnUrl,
+  resolveSessionExpiredNavigation,
   resolveUnauthenticatedStartupRedirect,
   waitForAuthenticationOutcome
 } from './auth-navigation.rules';
@@ -89,6 +90,28 @@ describe('resolveUnauthenticatedStartupRedirect', () => {
   });
 });
 
+describe('resolveSessionExpiredNavigation', () => {
+  const currentUser = { id: 'user-1' };
+
+  it('keeps an authenticated user on protected routes', () => {
+    expect(resolveSessionExpiredNavigation(currentUser, '/room/abc')).toEqual({ kind: 'stay' });
+  });
+
+  it('leaves the login page when the in-memory user is still authenticated', () => {
+    expect(resolveSessionExpiredNavigation(currentUser, '/login?returnUrl=%2Fservers')).toEqual({
+      kind: 'leave-auth-route',
+      returnUrl: '/servers'
+    });
+  });
+
+  it('sends fully signed-out users to login with a safe returnUrl', () => {
+    expect(resolveSessionExpiredNavigation(null, '/room/abc')).toEqual({
+      kind: 'navigate-login',
+      queryParams: { returnUrl: '/room/abc' }
+    });
+  });
+});
+
 describe('waitForAuthenticationOutcome', () => {
   it('resolves when authentication storage preparation succeeds', async () => {
     const user = {