Fix login redirect loop: replace cached /me actor, don't just invalidate

[luma-founder]

Summary

Login succeeded server-side (204 + Set-Cookie) but the SPA bounced the user back to /login. Root cause is purely frontend cache management.

Trace:

1. Page loads → useMe query runs → 401 → cached value is null.
2. User submits login → server returns 204, sets the session cookie.
3. useLogin.onSuccess ran invalidateQueries(["me"]) — but with no active observer (the login form doesn't use useMe), this only marks the query stale. No refetch.
4. navigate({ to: "/" }) fires → / route's beforeLoad calls ensureQueryData(meQueryOptions).
5. ensureQueryData returns the cached null regardless of stale flag.
6. Guard sees no actor → redirects back to /login.

fetchQuery would hit the same trap because meQueryOptions has staleTime: Infinity — fetchQuery returns cached when not stale.

Fix:

• useLogin.onSuccess — removeQueries(["me"]) to clear the cache, then await fetchQuery(meQueryOptions) to plant the fresh actor. Next ensureQueryData call sees the new value synchronously.
• useLogout.onSettled — setQueryData(["me"], null) directly. We already know the answer.

Test plan

• 2 new regression tests (23 total): seed cache pre-state, run the mutation, assert the cache holds the expected post-state.
• Live Docker against the API directly: pre-login /me → 401, login → 204 + cookie, post-login /me with same jar → 200 with actor. The backend was correct; only the frontend cache was the issue.