Root causes (both in app.js):
1. validateAuth() called API.get('/me') = /api/me, but the route is
mounted at /auth/me (businessRouter.use('/auth', authRoutes)).
/api/me returned 404 -> non-auth error was re-thrown -> outer
.catch() unconditionally Auth.reset() + redirect to #/login.
Fixed: call /auth/me; non-auth errors (network/404/500) now return
true (allow routing) instead of throwing.
2. init() fetched /api/settings/settings WITHOUT token, but that route
requires authenticate+requireRole. Always 401 -> __SITE_NAME__ never
set -> 'Auth.logged() && !window.__SITE_NAME__' always true ->
Auth.reset() on EVERY page load, wiping valid login.
Fixed: removed the fetch and the reset line - site_name is already
injected server-side as window.__SITE_NAME__ (getHtmlWithKey).
canglan
edf561729f