Fix document loading: circular FK, patch validation 500, and token expiry redirect

- documents.py: fix root_version_id never being saved due to SQLAlchemy
  deferring the circular FK (CvDocument↔CvVersion). Use flush-based approach:
  flush doc, flush version, then set root_version_id before final commit.
- config.py: add validator to coerce empty MINIO_ENDPOINT string to None,
  preventing boto3 ValueError: Invalid endpoint at startup.
- versions.py: catch PatchValidationError and return 422 instead of 500
  when a patch violates ATS guard rules.
- api.ts: on 401, clear stale OIDC cookies and redirect to /login instead
  of showing the "Failed to load documents" error.

https://claude.ai/code/session_01KKbzWYz8fLyG2qcwiDZ8fy

apps/webapp/src/libs/api.ts

@@ -92,6 +92,11 @@ async function req<T>(path: string, init?: RequestInit): Promise<T> {
         headers: { accept: 'application/json', ...getAuthHeader(), ...init?.headers },
     });
     if (!res.ok) {
+        if (res.status === 401 && typeof window !== 'undefined') {
+            document.cookie = 'oidc_token_pub=; max-age=0; path=/';
+            document.cookie = 'oidc_token=; max-age=0; path=/';
+            window.location.href = '/login';
+        }
         const detail = await res.text().catch(() => res.statusText);
         throw new Error(detail || `HTTP ${res.status}`);
     }