feat(routes): add access-denied route and update authentication flow

- Introduced a new Access Denied route to handle unauthorized access.
- Updated routing logic to redirect to the Access Denied page when necessary.
- Enhanced authentication checks to prevent infinite redirect loops and improve user experience.
- Adjusted API client to handle JWT rejection scenarios more gracefully.

apps/web/src/lib/api-client.ts

@@ -30,6 +30,13 @@ async function handoffOnUnauthorized(): Promise<void> {
     redirectToPortalLogin(`${window.location.origin}/auth/callback`)
     return
   }
+  // Cooldown / recent handoff — stop SSO storm (wrong JWT secret / issuer).
+  if (cfg.required || isAuthEnabled()) {
+    window.location.assign(
+      `${window.location.origin}/auth/callback?error=jwt_rejected`,
+    )
+    return
+  }
   if (!cfg.required && !isAuthEnabled()) {
     window.location.href = '/login'
   }