[SandObserver]

Summary

• Add recoversSession to admin-logic.js: a 401, excluding /api/auth/check and /api/auth/login, which are the requests signing in is made of.
• Intercept that case in ag and ap, raise the sign-in overlay through a registered handler, and reissue the request once, so the interrupted save completes itself.
• Share one sign-in between requests that fail together, since saveServer makes three writes in a row and each would otherwise raise its own overlay.
• Export requireLogin from admin-auth.js, resolving when the existing login screen reports success; the screen is position:fixed, so the editor underneath keeps its contents.
• Register the handler in admin.js rather than importing it into admin-shared.js, which the sign-in screen itself depends on.

Testing
All green. Added 12 tests: 7 driving the real retry path against a stubbed fetch (retry, no-loop, decline, shared sign-in, auth-path exclusion) and 5 on the rule.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.
• CHANGELOG.md updated under Unreleased if the change is user-visible.