auth provider cahnged

frontend/src/auth/AuthProvider.jsx

@@ -45,6 +45,23 @@ export default function AuthProvider({ children }) {
     if (me.data) mergeUser(me.data)
   }, [me.data])
 
+  // A failed /users/me means the stored session can no longer be trusted: the
+  // token is dead, the account was deactivated, or — the case this exists for —
+  // the record predates a role change and its cached identity and permissions
+  // are simply wrong. Purge it instead of leaving it on disk, because the
+  // optimistic paint below treats cached permissions as good enough to render
+  // the shell, so a stale record keeps showing the old role and the old nav on
+  // every load until someone clears storage by hand.
+  //
+  // Genuine expiry is already handled upstream (apiClient refreshes, and calls
+  // the session-expired handler when that fails); this catches everything else.
+  useEffect(() => {
+    if (!me.isError) return
+    clearSession()
+    qc.clear()
+    navigate('/auth/login?expired=1', { replace: true })
+  }, [me.isError, navigate, qc])
+
   const signIn = useCallback(
     async (email, password) => {
       const res = await authApi.login(email, password)
@@ -64,8 +81,11 @@ export default function AuthProvider({ children }) {
     navigate('/auth/login', { replace: true })
   }, [navigate, qc])
 
-  const user = me.data ?? session?.data ?? null
-  const permissions = me.data?.permissions ?? session?.data?.permissions ?? null
+  // Once /users/me has failed the cached snapshot is not a fallback, it is the
+  // thing that was wrong — serving it would paint a stale name, role and nav.
+  const cachedUser = me.isError ? null : session?.data
+  const user = me.data ?? cachedUser ?? null
+  const permissions = me.data?.permissions ?? cachedUser?.permissions ?? null
 
   const status = !session?.access_token
     ? 'anonymous'