fix(ui): audit remediation for auth, errors, and environment handling

[CluelessBiker]

Summary

Follow-up fixes from a full-stack audit of Conduit and Conduit-UI. This PR tightens session handling, API error paths, and multi-environment configuration in the admin panel.

• Smarter 401 handling — Session-timeout redirects only fire when a real session cookie exists, and auth endpoints (/login, /verify-twofa) are excluded so failed logins do not loop.
• Secure cookie defaults — Auth cookies use secure, sameSite: 'lax', and maxAge derived from the JWT expiry instead of a fixed duration.
• Canonical environment names — Login, logout, 2FA, and the 401 interceptor all resolve env names through EnvManager so cookie names stay consistent across mixed-case inputs.
• EnvManager fingerprint — Environment config changes (base URL, master key) are detected reliably via a SHA-256 fingerprint, including multi-env setups.
• Shared error helpers — Replaces communications-api-error.ts with api-error.ts for consistent Axios and communications error formatting across modules.
• Database API — getSchemaDocument rethrows non-404 errors instead of swallowing them.
• Global error page — "Go Home" uses a full page navigation so it works when the app shell is broken.

Why

The audit found that loose 401 redirects and mismatched cookie names could cause false logouts or broken session-timeout flows on remote environments. Fixed cookie lifetimes and env name normalization reduce those failures. Centralized error helpers make API failures easier to diagnose in production.

Related PRs

• Conduit (backend): Conduit PR #1568 — audit remediation for caching, rate limiting, and ops on the platform side. Land both PRs together for the full audit fix.
• Conduit-UI (templates): Conduit-UI PR #301 — client-side template loading with graceful API failures. This PR improves auth and error infrastructure that PR fix(communications): load templates client-side with graceful API failures #301 depends on; PR fix(communications): load templates client-side with graceful API failures #301 should still merge for the client-fetch and degraded-mode UI on /communications/templates and /communications/test.

Test plan

• Log in, wait for session expiry — confirm redirect to /login?session-timeout=true
• Failed login with wrong password — no redirect loop
• Switch between configured environments — cookies use correct names
• Open a communications template detail page — API errors surface clearly
• Trigger global error boundary — "Go Home" navigates to /