[aevnsvi]

Adds unit and component tests for the session behaviours of the UI. Tests only, no production source change.

Login page

• a refused sign-in for a user name with Polish letters shows the server message, raises no unhandled error and sends a Basic header built from UTF-8 bytes
• an unreachable server is reported as such
• the page has no remember option and no plain-text storage warning
• a protocol-relative next target is ignored (sign-in ends on the status page); a same-origin next path is honoured

User context

• on start the legacy credentials keys are removed from both storages without being read, and GET login/ is asked once
• logout answered 204 or 401 ends signed out; 403 or 500 keeps the user signed in and rejects with the server's reason

Route guard

• a protected route shows a loading state while the session check runs, keeps the deep link on 200 and redirects to login only on 401

API client

• every request carries X-Requested-With and sends cookies
• X-CSRFToken is read from the csrftoken cookie for each request, so a changed cookie changes the next header; none is sent without the cookie
• no request carries an Authorization header unless the caller sets one

The whole suite also passes with --sequence.shuffle. No test uses it.fails or it.todo.