fix(web): keep the signed-out message alive and unqueued

Two ways the one message telling a user their write failed could never reach
them:

- signOut raised a toast and then assigned window.location, and a document
  navigation tears the toast down. The early return meant this only happened
  on routes other than the calendar, which is exactly where the message was
  needed. Route in-app instead, the same way SessionExpiredToast already
  reaches the router.
- ToastContainer allowed one toast at a time, so any routine toast already on
  screen silently queued out a critical one behind it.

Adds coverage for the navigating branch, which had none.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: tyler-dane

packages/web/src/api/util/api.util.test.ts

@@ -268,4 +268,28 @@ describe("handleErrorResponse", () => {
     expect(signOutSpy).toHaveBeenCalledTimes(1);
     signOutSpy.mockRestore();
   });
+
+  it("leaves a non-calendar route through the router, not a document navigation", async () => {
+    // A document navigation tears down the toast signOut just raised, so on
+    // every route that actually needed it the "you've been signed out" message
+    // was destroyed before it could be read. Routing in-app keeps it alive.
+    window.history.pushState({}, "", "/day/2026-07-31");
+    const navigate = mock((_options: { to: string }) => Promise.resolve());
+    mock.module("@web/routers", () => ({ router: { navigate } }));
+    const signOutSpy = spyOn(session, "signOut").mockResolvedValue(undefined);
+    const error = createApiError(
+      { status: Status.UNAUTHORIZED },
+      { url: "/event" },
+    );
+
+    await expect(
+      handleErrorResponse(error, { onGoogleRevoked: undefined }),
+    ).rejects.toBe(error);
+
+    expect(signOutSpy).toHaveBeenCalledTimes(1);
+    expect(navigate).toHaveBeenCalledTimes(1);
+    expect(navigate).toHaveBeenCalledWith({ to: "/week" });
+    signOutSpy.mockRestore();
+    window.history.pushState({}, "", "/week");
+  });
 });

packages/web/src/api/util/api.util.ts

@@ -7,7 +7,6 @@ import {
 import { session } from "@web/auth/compass/session/Session";
 import { ENV_WEB } from "@web/common/constants/env.constants";
 import { DEFAULT_CALENDAR_ROUTE } from "@web/common/constants/routes";
-import { assignLocation } from "@web/common/utils/browser/browser-navigation.util";
 import {
   showErrorToast,
   showSessionExpiredToast,
@@ -91,7 +90,13 @@ export const signOut = async (status: SignoutStatus) => {
   if (window.location.pathname.startsWith(DEFAULT_CALENDAR_ROUTE)) {
     return;
   }
-  assignLocation(DEFAULT_CALENDAR_ROUTE);
+  // Navigate in-app rather than assigning window.location: a document
+  // navigation tears down the toast we just raised, so the one message telling
+  // the user they were signed out was destroyed on every route that needed it.
+  // Imported dynamically for the same module-cycle reason SessionExpiredToast
+  // documents (this file sits on the API error path the router pulls back in).
+  const { router } = await import("@web/routers");
+  await router.navigate({ to: DEFAULT_CALENDAR_ROUTE });
 };
 
 export const getRequestUrl = (url: string): string => {

packages/web/src/components/CompassProvider/CompassProvider.tsx

@@ -40,7 +40,10 @@ function ThemeAwareToastContainer() {
       draggable
       pauseOnHover
       theme={theme === "dark-abyss" ? "dark" : "light"}
-      limit={1}
+      // Not 1: with a single slot, a routine toast already on screen (an undo
+      // notice, an autosave) silently queues out a critical one behind it, so
+      // "your session expired" or "that didn't save" could never appear.
+      limit={3}
       transition={Slide}
     />
   );