fix(auth): stop infinite /auth/me request loop when logged out

The axios 401 interceptor calls clearAuthClientState() on every 401, which
dispatched "auth-changed"; the App handler re-fetched /auth/me, which 401'd
again → interceptor → clearAuthClientState() → "auth-changed" → ... an unbounded
request storm (observed live: 100+ GET /auth/me and climbing) that ran whenever
the user was logged out (login page, expired session) — burning CPU, network and
battery and flooding the server.

Fix: make clearAuthClientState idempotent — only emit "auth-changed" when it
actually removes a stored user key (a real signed-in→out transition), so
repeated 401s can no longer re-trigger the fetch.

Runtime-verified in a live stack: /auth/me went from 100+ & growing to 0 &
stable. login-page/settings tests green. Documented in
docs/performance/PERFORMANCE_IMPROVEMENTS.md (Phase 3.5 runtime finding).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

job-tracker-ui/src/auth.ts

@@ -82,8 +82,14 @@ export function setAuthUserKey(value: string | null | undefined, emit = true) {
 }
 
 export function clearAuthClientState(emit = true) {
+  // Only emit "auth-changed" when this call actually transitions from
+  // "signed in" to "signed out". The response interceptor calls this on every
+  // 401; without this guard each 401 re-dispatches "auth-changed", which
+  // re-fetches /auth/me, which 401s again — an infinite request loop whenever
+  // the user is logged out (login page, expired session).
+  const had = safeGet(window.localStorage, AUTH_USER_KEY) != null;
   safeRemove(window.localStorage, AUTH_USER_KEY);
-  if (emit) emitAuthChanged();
+  if (emit && had) emitAuthChanged();
 }
 
 export function getCsrfToken(): string | null {