Why: password logins hand the browser an HttpOnly session cookie, but a stale Bearer key left in localStorage shadows it server-side (Bearer is checked first), so every request after login returns 401 and refreshes bounce back to the login page. Evidence: frontend commit 09310cb (vitest 19 files / 88 tests green); combined make test in this worktree recorded via evidence into the task card. Impact: dev-instance UIs reachable by LAN IP or hostname log in cleanly with username+password; API-key flow unchanged. Refs: .task/feature-login-clear-stale-key.md
ui
@ 6f68a9579d