fix(web): hide signed-out toast for first-time visitors

[tyler-dane]

Summary

First-time visitors (incognito / new users) were immediately seeing You've been signed out. Please sign in again. on staging, next to the Welcome modal.

The API error interceptor treated every 401/410 as session expiry. A brand-new browser can still get those statuses (SuperTokens session refresh on the first API call, or a protected route with no session). That is “not signed in,” not “you were signed out.”

The toast now only appears when this browser has authenticated before (hasUserEverAuthenticated). SuperTokens session wiring listens only to lifecycle onHandleEvents, not postAPIHook payloads that reuse the REFRESH_SESSION name.

Simplicity

Gate stays as two one-line checks at the interceptor and profile catch. No new helpers or modules. SuperTokens apiDomain now uses the origin (BACKEND_BASEURL), matching the backend.

Automated validation

• Unit: first-time visitor 401 does not call session.signOut or show the toast; returning visitor still does.
• Profile load: first-time 401 stays quiet; returning visitor still toasts.
• bun run test:web — pass
• bun run lint — pass (existing repo warnings only)
• GitHub CI: lint, type-check, knip, unit (core/web/backend/sync/scripts), e2e, CodeQL — pass

Independent review

Fresh read-only review of the full origin/main diff: no confirmed findings. Logout still clears local auth state; interceptor signOut keeps the flag so a returning expired session still gets the toast.

Test plan

• bun packages/scripts/src/testing/test-parallel.ts web -- packages/web/src/api/util/api.util.test.ts packages/web/src/auth/compass/user/hooks/useLoadProfile.test.ts
• bun packages/scripts/src/testing/test-parallel.ts web -- packages/web/src/auth/compass/session/SessionProvider.test.tsx
• bun run test:web
• bun run lint
• GitHub Actions Test + CodeQL on the PR