fix: avoid admin route fan-out on denied capabilities (#67)

Author: danny-avila

src/hooks/useCapabilities.ts

@@ -8,6 +8,8 @@ const Route = getRouteApi('/_app');
 
 /** Status codes that indicate the grants system is not deployed (vs. access denied). */
 const GRANTS_UNAVAILABLE_PATTERN = /\b(404|503)\b|endpoint not found|fetch failed/i;
+const AUTH_DENIED_PATTERN =
+  /\b(401|403)\b|forbidden|unauthorized|authentication required|no admin session token/i;
 
 export function useCapabilities(): {
   capabilities: string[];
@@ -27,6 +29,9 @@ export function useCapabilities(): {
         if (GRANTS_UNAVAILABLE_PATTERN.test(message)) {
           return { available: false, capabilities: [] as string[] };
         }
+        if (AUTH_DENIED_PATTERN.test(message)) {
+          return { available: true, capabilities: [] as string[] };
+        }
         throw err;
       }
     },