fix(panel): the /tg surface is exempt from the global 401→login redirect (#600)

The app-level agent-roster sync fires /api/agents on every surface; on
/tg it races the initData sign-in, takes the cloud-auth 401, and the
interceptor bounced the Telegram webview to the password /login page it
cannot complete — hijacking the cockpit into the dashboard. The Mini App
owns its auth UX (initData sign-in + its own wall), so the redirect now
exempts /tg via an exported, tested path predicate.

Co-authored-by: Renn F <rennf93@users.noreply.github.com>

panel/src/lib/__tests__/client.test.ts

@@ -30,7 +30,7 @@ vi.mock("@/store/rate-limit-store", () => ({
 // ---------------------------------------------------------------------------
 // Import the function under test AFTER mocks are in place
 // ---------------------------------------------------------------------------
-import { getErrorMessage } from "@/lib/api/client";
+import { getErrorMessage, isTgSurfacePath } from "@/lib/api/client";
 
 // ---------------------------------------------------------------------------
 // Helpers
@@ -212,3 +212,17 @@ describe("getErrorMessage — non-Axios fallbacks", () => {
     );
   });
 });
+
+describe("isTgSurfacePath — the /tg login-redirect exemption", () => {
+  it("matches the cockpit root and subpaths", () => {
+    expect(isTgSurfacePath("/tg")).toBe(true);
+    expect(isTgSurfacePath("/tg/")).toBe(true);
+  });
+
+  it("does not match the dashboard or lookalike segments", () => {
+    expect(isTgSurfacePath("/overview")).toBe(false);
+    expect(isTgSurfacePath("/tgsomething")).toBe(false);
+    expect(isTgSurfacePath("/login")).toBe(false);
+    expect(isTgSurfacePath("/")).toBe(false);
+  });
+});