Fix authenticated City Analysis queries

docs/DEVELOPMENT_AND_STAGING.md

@@ -115,6 +115,24 @@ At commit `de6f279`, all five checks pass and both audit scopes report zero know
 
 Known limitation: direct browser refreshes on newer client-side routes such as `/faktiska` can return 404 because the backend static-route list does not yet provide a general SPA fallback. Navigate from the home page until that backend behavior is fixed.
 
+## Authenticated API requests
+
+The public Nginx configuration deliberately handles `/api/` separately from
+browser page requests. An expired Authelia session must return the original
+HTTP 401 to an API request; it must not redirect `fetch`/XHR to
+`auth.laikapstak.li`. A cross-origin authentication redirect is blocked by the
+browser as CORS and previously left City Analysis appearing to load forever.
+
+The frontend also applies a 30-second query timeout and presents explicit
+session, network, HTTP, unexpected-response, and empty-result messages. When
+changing the authentication or proxy configuration, verify both an authorized
+query and an expired-session query rather than checking page navigation alone.
+
+The UAT synthetic dataset is time-bounded. If its latest observation predates
+the default City Analysis range, refresh the small test seed; an empty result is
+not an ingestion or authentication failure. Synthetic data exists only for
+visual workflow testing and must be removed before real provider ingestion.
+
 ## Rollback
 
 Prefer a normal Git revert rather than manually copying old files:

docs/VPS_STAGING_PLAN.md

@@ -293,6 +293,8 @@ development convenience, not the proposed VPS release model.
 - Valid login, session persistence, logout, throttling, and temporary ban
   recovery work.
 - `/`, City Analysis, Faktiskā, and Ūdens temperatūra work with synthetic data.
+- An expired session on `/api/` returns HTTP 401 without a cross-origin redirect;
+  the UI leaves its loading state and explains how to sign in again.
 - Required PNG dimensions and filenames remain correct after deployment.
 - Browser developer tools and container/Nginx/Authelia logs show no unexpected
   errors or secret values.