Clear Web UI session on 401 and keep API/Ingress errors as JSON.

Include the missing resource id in not-found messages, expire auth to Guest
after 401, and document Ingress annotations so nginx does not rewrite 404/405
bodies into branded HTML.

app/web/index.html

@@ -4982,12 +4982,7 @@
         if (!res.ok) throw new Error("session expired");
         setAuth(true);
       } catch {
-        state.ticket = null;
-        state.csrf = null;
-        state.username = null;
-        state.project = null;
-        localStorage.removeItem(LS_AUTH);
-        setAuth(false);
+        clearSession({ closePanel: false });
       }
     }
 
@@ -6342,6 +6337,25 @@
       }
     }
 
+    function clearSession(options = {}) {
+      const { toastMessage = null, toastKind = "info", closePanel = true } = options;
+      state.ticket = null;
+      state.csrf = null;
+      state.username = null;
+      state.project = null;
+      try {
+        localStorage.removeItem(LS_AUTH);
+        sessionStorage.removeItem(LS_AUTH);
+      } catch {
+        /* ignore storage failures */
+      }
+      setAuth(false);
+      persistAuth();
+      if (closePanel) closeAuthPanel();
+      resetClusterStats("—");
+      if (toastMessage) toast(toastMessage, toastKind);
+    }
+
     function logout() {
       const token = state.ticket;
       if (token) {
@@ -6350,15 +6364,15 @@
           headers: { "X-Auth-Token": token, "X-Subject-Token": token },
         }).catch(() => {});
       }
-      state.ticket = null;
-      state.csrf = null;
-      state.username = null;
-      state.project = null;
-      setAuth(false);
-      persistAuth();
-      closeAuthPanel();
-      resetClusterStats("—");
-      toast("Signed out", "info");
+      clearSession({ toastMessage: "Signed out", toastKind: "info" });
+    }
+
+    function expireSession() {
+      clearSession({
+        toastMessage: "Session expired — sign in again",
+        toastKind: "warn",
+        closePanel: false,
+      });
     }
 
     function updateStatusBadge(status) {
@@ -6472,6 +6486,9 @@
       const text = await res.text();
       let parsed;
       try { parsed = JSON.parse(text); } catch { parsed = text; }
+      if (res.status === 401 && (state.ticket || state.username)) {
+        expireSession();
+      }
       return { status: res.status, body: parsed, durationMs: Math.round(performance.now() - started) };
     }