fix(auth): 401 dal backend svuota la sessione e segnala session_expired (#25)

api_client._handle_response: su 401 pulisce la sessione Flask e marca
g.session_expired. Un solo after_request (app.py) trasforma le pagine HTML
rimaste in piedi con un errore generico in un redirect al login con flash;
le route JSON/AJAX che già inoltrano il dict di api_client (measure.py,
statistics.py) ricevono session_expired nel corpo insieme al 401.
Backend (riuso della key, bcrypt a tempo costante) resta al lotto A2.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/tests/test_session_expired.py

@@ -0,0 +1,100 @@
+"""Tests for the 401 -> session-expired handling (#25, frontend half).
+
+Backend half (auth_service key reuse, constant-time auth) is lot A2 and
+lives in src/backend - not covered here.
+"""
+from unittest.mock import MagicMock, patch
+
+from flask import g, session
+
+
+def _mock_401_response(detail="Invalid or expired API key"):
+    resp = MagicMock()
+    resp.ok = False
+    resp.status_code = 401
+    resp.json.return_value = {"detail": detail}
+    resp.text = detail
+    return resp
+
+
+class TestApiClientHandlesResponse:
+    """Unit-level: services/api_client.py clears the session on 401."""
+
+    def test_401_clears_session_and_flags_g(self, flask_app):
+        from services.api_client import api_client
+
+        with flask_app.test_request_context("/"):
+            session["api_key"] = "stale-key"
+            session["user"] = {"id": 1, "username": "op1"}
+
+            result = api_client._handle_response(_mock_401_response())
+
+            assert result["error"] is True
+            assert result["status_code"] == 401
+            assert result["session_expired"] is True
+            assert "api_key" not in session
+            assert "user" not in session
+            assert g.session_expired is True
+
+    def test_non_401_error_does_not_touch_session(self, flask_app):
+        from services.api_client import api_client
+
+        with flask_app.test_request_context("/"):
+            session["api_key"] = "still-good"
+
+            resp = MagicMock(ok=False, status_code=404)
+            resp.json.return_value = {"detail": "not found"}
+            result = api_client._handle_response(resp)
+
+            assert "session_expired" not in result
+            assert session.get("api_key") == "still-good"
+            assert not getattr(g, "session_expired", False)
+
+
+class TestHtmlPageRedirectsOnSessionExpired:
+    """Integration: a page view that got a 401 ends up redirected to login."""
+
+    def test_recipe_list_401_redirects_to_login(self, logged_in_client):
+        with patch("services.api_client.requests.get", return_value=_mock_401_response()):
+            resp = logged_in_client.get("/maker/recipes", follow_redirects=False)
+
+        assert resp.status_code == 302
+        assert "/auth/login" in resp.headers["Location"]
+
+    def test_recipe_list_401_empties_the_session(self, logged_in_client):
+        with patch("services.api_client.requests.get", return_value=_mock_401_response()):
+            logged_in_client.get("/maker/recipes", follow_redirects=False)
+
+        with logged_in_client.session_transaction() as sess:
+            assert "api_key" not in sess
+            assert "user" not in sess
+
+    def test_recipe_list_401_flashes_session_expired_message(self, logged_in_client):
+        with patch("services.api_client.requests.get", return_value=_mock_401_response()):
+            resp = logged_in_client.get("/maker/recipes", follow_redirects=True)
+
+        assert "Sessione scaduta" in resp.get_data(as_text=True)
+
+
+class TestJsonProxyReturns401WithFlag:
+    """Integration: an AJAX proxy route surfaces session_expired in its JSON body."""
+
+    def test_save_measurement_401_returns_session_expired_flag(self, logged_in_client):
+        with patch("services.api_client.requests.post", return_value=_mock_401_response()):
+            resp = logged_in_client.post(
+                "/measure/save-measurement",
+                json={"subtask_id": 1, "version_id": 1, "value": 1.0},
+            )
+
+        assert resp.status_code == 401
+        body = resp.get_json()
+        assert body["error"] is True
+        assert body["session_expired"] is True
+
+    def test_statistics_summary_401_returns_session_expired_flag(self, logged_in_client):
+        with patch("services.api_client.requests.get", return_value=_mock_401_response()):
+            resp = logged_in_client.get("/statistics/api/summary")
+
+        assert resp.status_code == 401
+        body = resp.get_json()
+        assert body["session_expired"] is True