auth

When navigation and route guards are written separately, they disagree. Derive both from one permission map and the disagreement becomes impossible.

When a token expires mid-page, every in-flight request fails at once. Queue them behind one refresh instead of firing one per failure.

Access tokens in JavaScript are readable by any script on the page. A thin backend-for-frontend removes the problem instead of managing it.