merge: integrate upstream main with local Makelore changes

tests/unit/app-module-provider-gate.test.tsx

@@ -31,6 +31,10 @@ vi.mock('@/pages/ModuleSelection', () => ({
   ModuleSelection: () => <div>Module chooser</div>,
 }));
 
+vi.mock('@/pages/Login', () => ({
+  Login: () => <div data-testid="login-surface">Login surface</div>,
+}));
+
 vi.mock('@/pages/Settings', () => ({
   Settings: () => <div>Global settings</div>,
 }));
@@ -91,6 +95,21 @@ describe('App programming provider initialization gate', () => {
     await waitFor(() => expect(initProviders).toHaveBeenCalledTimes(1));
   });
 
+  it('redirects an orphaned token without a user identity away from a direct workspace route', async () => {
+    useAuthStore.setState({
+      initialized: true,
+      accessToken: 'orphaned-access-token',
+      expiresAt: Date.now() + 60_000,
+      user: null,
+    });
+
+    await renderAt('/chat');
+
+    expect(await screen.findByTestId('login-surface')).toBeInTheDocument();
+    expect(screen.queryByTestId('main-layout')).not.toBeInTheDocument();
+    expect(initProviders).not.toHaveBeenCalled();
+  });
+
   it('waits for the startup module policy before initializing programming providers', async () => {
     useAuthStore.setState({
       initialized: false,