fix(auth): avoid stale redirects after auth changes

Use full-page navigation after login/logout so the dashboard reloads
with the fresh auth cookie, and mark login/logout responses no-store.

Fixes #2100

Co-authored-by: Cursor <cursoragent@cursor.com>

src/app/login/page.js

@@ -2,7 +2,6 @@
 
 import { useState, useEffect } from "react";
 import { Card, Button, Input } from "@/shared/components";
-import { useRouter } from "next/navigation";
 
 export default function LoginPage() {
   const [password, setPassword] = useState("");
@@ -16,7 +15,6 @@ export default function LoginPage() {
   const [oidcLoginLabel, setOidcLoginLabel] = useState("Sign in with OIDC");
   const [mustChange, setMustChange] = useState(false);
   const [newPassword, setNewPassword] = useState("");
-  const router = useRouter();
 
   // Countdown for rate-limit
   useEffect(() => {
@@ -40,8 +38,7 @@ export default function LoginPage() {
         if (res.ok) {
           const data = await res.json();
           if (data.requireLogin === false) {
-            router.push("/dashboard");
-            router.refresh();
+            window.location.assign("/dashboard");
             return;
           }
           setHasPassword(!!data.hasPassword);
@@ -58,7 +55,7 @@ export default function LoginPage() {
       }
     }
     checkAuth();
-  }, [router]);
+  }, []);
 
   const handleLogin = async (e) => {
     e.preventDefault();
@@ -79,8 +76,7 @@ export default function LoginPage() {
           setMustChange(true);
           return;
         }
-        router.push("/dashboard");
-        router.refresh();
+        window.location.assign("/dashboard");
       } else {
         const data = await res.json();
         setError(data.error || "Invalid password");
@@ -106,8 +102,7 @@ export default function LoginPage() {
         body: JSON.stringify({ currentPassword: password, newPassword }),
       });
       if (res.ok) {
-        router.push("/dashboard");
-        router.refresh();
+        window.location.assign("/dashboard");
       } else {
         const data = await res.json();
         setError(data.error || "Failed to set password");