Fix document loading: circular FK, patch validation 500, and token expiry redirect

- documents.py: fix root_version_id never being saved due to SQLAlchemy
  deferring the circular FK (CvDocument↔CvVersion). Use flush-based approach:
  flush doc, flush version, then set root_version_id before final commit.
- config.py: add validator to coerce empty MINIO_ENDPOINT string to None,
  preventing boto3 ValueError: Invalid endpoint at startup.
- versions.py: catch PatchValidationError and return 422 instead of 500
  when a patch violates ATS guard rules.
- api.ts: on 401, clear stale OIDC cookies and redirect to /login instead
  of showing the "Failed to load documents" error.

https://claude.ai/code/session_01KKbzWYz8fLyG2qcwiDZ8fy

apps/backend/fastapi/app/api/routes/versions.py

@@ -7,6 +7,7 @@ from app.api.deps import get_current_user, get_db
 from app.schemas import BranchCreateRequest, VersionResponse
 from app.services.versions import create_branch, delete_version
 from dlib.auth import AuthenticatedUser
+from dlib.cv.ats_guard import PatchValidationError
 
 
 router = APIRouter(prefix="/versions", tags=["versions"])
@@ -18,14 +19,17 @@ async def create_version_branch(
     session: AsyncSession = Depends(get_db),
     user: AuthenticatedUser = Depends(get_current_user),
 ):
-    version = await create_branch(
-        session,
-        owner_id=user.sub,
-        parent_version_id=payload.parent_version_id,
-        branch_name=payload.branch_name,
-        version_label=payload.version_label,
-        patches=payload.patches,
-    )
+    try:
+        version = await create_branch(
+            session,
+            owner_id=user.sub,
+            parent_version_id=payload.parent_version_id,
+            branch_name=payload.branch_name,
+            version_label=payload.version_label,
+            patches=payload.patches,
+        )
+    except PatchValidationError as exc:
+        raise HTTPException(status_code=422, detail=str(exc)) from exc
     if not version:
         raise HTTPException(status_code=404, detail="Parent version not found")
     return VersionResponse.model_validate(version)