SessionStore.handle existed but had no callers — a revoked token rendered as a failed state on every screen and never signed out. GitbayClient now carries an onUnauthorized hook fired whenever a 401 is mapped; SessionStore attaches it when an account is activated. The sign-in probe client gets no hook, so a mistyped token stays a sign-in error.
Two new tests (a 401 on a later request signs out and clears the Keychain; a rejected sign-in does not trip the watcher), plus a live check: launched with the actually-revoked token, first request met the 401, landed on the sign-in screen with the explanation.
Ref #11