Cookie auth challenge should always 401 for /api/*, never redirect

[antosubash]

Anonymous probes against API routes return inconsistent status codes:

GET /api/invoices       → 401
GET /api/invoices/1     → 302 → /Identity/Account/Login?ReturnUrl=…
GET /api/invoices/1/pdf → 302 → /Identity/Account/Login?ReturnUrl=…
POST /api/customers     → 401
POST /api/invoices/1/mark-paid → 401
DELETE /api/invoices/1  → 302

Same authorization, different responses. JS clients that check if (res.status === 401) renewToken() get into redirect chains for some paths. Cookie-auth's challenge appears to sniff the Accept header / route shape and sometimes redirects.

Not a security bug

Both 401 and 302 block anonymous access. This is a UX wart, not a hole.

Fix

In the framework's cookie-auth setup, override OnRedirectToLogin to detect /api/* request paths and return 401 unconditionally:

services.ConfigureApplicationCookie(options =>
{
    var existing = options.Events.OnRedirectToLogin;
    options.Events.OnRedirectToLogin = ctx =>
    {
        if (ctx.Request.Path.StartsWithSegments("/api"))
        {
            ctx.Response.StatusCode = 401;
            return Task.CompletedTask;
        }
        return existing(ctx);
    };
});