feat: landing page + logo, dev-mode banner + sync cap, non-blocking sync with progress splash

src/InboxIntel.Api/Program.cs

@@ -38,13 +38,30 @@ var google = builder.Configuration.GetSection(GoogleOAuthOptions.SectionName).Ge
 builder.Services.AddAuthentication(options =>
     {
         options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
-        options.DefaultChallengeScheme = GoogleDefaults.AuthenticationScheme;
+        // Challenge via the cookie scheme so unauthenticated API (XHR) calls get a
+        // 401 instead of a redirect to Google. The SPA's axios interceptor turns
+        // that 401 into a top-level navigation to /auth/login, which then starts
+        // the Google flow explicitly. (A 302 to Google on an XHR is CORS-blocked.)
+        options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
     })
     .AddCookie(options =>
     {
         options.Cookie.HttpOnly = true;
         options.Cookie.SameSite = SameSiteMode.Lax;
+        options.Cookie.Name = "inboxintel.session";
         options.ExpireTimeSpan = TimeSpan.FromDays(7);
+        options.SlidingExpiration = true;
+        // API-style behaviour: return status codes rather than redirecting to a login page.
+        options.Events.OnRedirectToLogin = ctx =>
+        {
+            ctx.Response.StatusCode = StatusCodes.Status401Unauthorized;
+            return Task.CompletedTask;
+        };
+        options.Events.OnRedirectToAccessDenied = ctx =>
+        {
+            ctx.Response.StatusCode = StatusCodes.Status403Forbidden;
+            return Task.CompletedTask;
+        };
     })
     .AddGoogle(options =>
     {