fix(cluster): send a terminated cluster's in-cluster bookmarks to its overview

[dawsontoth]

⊙ Problem

A sign-in remembered from before a cluster was terminated still opened its apps, databases, APIs, operations, status, logs and config pages (#1931). Those pages sent operations to hosts central manager had torn down. The overview also checked that sign-in against the dead host, and nothing ever forgot it.

🤔 Should every in-cluster page refuse a terminated cluster?

Yes. #1830 and #1926 already treat a terminated cluster as having nothing left to work with. These pages only talk to its instances. A removed self-hosted cluster needs a decision; see Alternatives.

💡 Solution

• The in-cluster guard sends a deleted cluster to its overview before any sign-in work. With no sign-in, the overview replaces /sign-in as the landing page.
• The overview no longer checks a deleted cluster's sign-in.
• Studio forgets a terminated cluster's sign-ins, its own and every instance's, when termination succeeds and when any of its pages renders.
• Live clusters look the same. The overview's self-hosted and setup branches, which never used the cluster sign-in, stop checking it too.

⚖️ Alternatives

• Forget in the route guard: guards also run on hover preloads, so a hover would delete stored credentials.
• Read the instances only after termination: one failed read would leave every instance's credential behind. The record is also read alongside the DELETE.
• Check in the two route definitions instead of inside the guard: two call sites that must stay ahead of the sign-in work.

🤔 What about a self-hosted cluster removed from Fabric?

Its in-cluster pages redirect too, but its sign-ins are kept. Its servers may still run. Forgetting them locally would leave their sessions open after an app sign-out. Keeping them lets the next app sign-out log them out. Changing terminatedClusterSignIns would reverse it.

🤔 Should Studio forget nothing when it can't read the cluster?

I chose yes. If both reads around a successful terminate fail, Studio can't tell whether the cluster was self-hosted. It forgets nothing; the next visit to any of its pages clears the sign-ins. The alternative clears the cluster's own sign-in and risks dropping a live self-hosted session.

🔧 Changes

• instanceLayoutRoute.ts: checkClusterInstanceAuthenticationBeforeLoad calls redirectAwayFromDeletedCluster first, ahead of the Fabric Connect restore and the sign-in check. redirectAwayFromDeletedCluster.ts's doc comment now covers in-cluster pages.
• ClusterHome.tsx: the outer component no longer calls useInstanceAuth; it keeps the cluster query and the branch order. The live managed body, with useInstanceAuth and the connect callbacks, moves to ManagedClusterHome, which only a live cluster renders.
• authStore.ts: new signOutEntitiesLocally(ids) runs signOutLocally once per unique id and catches each failure. It sits beside signOutLocally and leaves signOutAllLocally, which fix(auth): drop a stale API explorer credential when a tab reloads after missing a sign-out #1956 changes, alone.
• terminatedClusterSignIns.ts: returns the cluster's id and each instance's, or none for a self-hosted cluster.
• terminateCluster.ts: reads the cluster alongside the DELETE, again after it if that failed, then forgets its sign-ins. The organization's cluster list carries no instances.
• ClusterLayout.tsx: reads the cluster from the cache without fetching, and forgets the sign-ins once per set of ids when the cluster is terminated and not TERMINATING.
• cluster/DESIGN.md records the overview rule, the forget points and the self-hosted exception. The root index mentions them.

✅ Verification

End-to-end route test (b) renders the whole app. Not tried against a live terminated cluster on stage.

• terminatedClusterDeepLink.test.tsx renders the real AppRouted and route tree with sign-ins remembered in storage. Cluster and instance bookmarks into a TERMINATED cluster land on "Cluster Terminated" at the overview, call no user_info, registration_info or token mint, and forget every sign-in. A removed self-hosted cluster keeps them.
• Unit tests cover each piece: ClusterHome.signIns.test.tsx, ClusterLayout.test.tsx, terminateCluster.test.ts and signOutEntitiesLocally.test.ts. The guard runs through the real route hooks in redirectAwayFromDeletedCluster.test.ts and rememberedClusterDeepLink.test.ts, which also shows a route load or preload never forgets.
• Each new test fails on the code before it, with the bug's own signature, and each mutation below turns one red.
• vitest --maxWorkers=4 (557 files, 5,653 passed), tsc -b, oxlint and dprint check exit 0 on Node 24.21.0.

Fails-on-base and mutation checks

• Guard redirect, against stage: all 112 route-matrix cases fail with expected undefined to be '/org-1/clu-1', and the router tests stay on the bookmarked page.
• Overview, terminate and forget, against this PR's first head (349e6f8): the overview tests see one user_info call, the terminate and layout tests find every sign-in still stored, and the whole-app test finds them too.
• Mutations, each turning at least one test red: removing the guard redirect; putting useInstanceAuth back in the overview's deleted branch; dropping the layout's forget; forgetting on TERMINATING; keying the forget on the polled record; dropping the self-hosted exception; dropping the read-back after the DELETE; clearing the cluster id when neither read succeeds; dropping the batch's dedupe and its per-id catch, which each have their own test; forgetting from the route guard.

The route matrix

• Deleted shapes: TERMINATED, TERMINATING, REMOVED, FAILED with terminatedAt.
• Pages: apps, databases, apis, operations, status, logs, config at the cluster level, and the same seven under instance/ins-1/ (apps is the instance index).
• For each: a remembered direct sign-in lands on the overview without a sign-in check; a remembered Fabric Connect flag lands there without a reconnect.
• Controls: RUNNING and FAILED without terminatedAt still render every page on the remembered sign-in.

Closes #1931

🤖 Generated with Claude Code

Related PRs: #1956 overlaps (both edit authStore.ts and the root DESIGN.md index; this adds a separate method beside signOutLocally)
Complexity: medium

_{Review-Coverage: authored=claude; ran=gemini,codex,cursor-composer; adjudicated=domain; declined=cursor-grok,cursor-kimi,cursor-muse,muse; rounds=5; full=1 @ dd9d36f}

_{Review-Attention: study ~15m (sensitive: authStore.ts; decisions: unreadable-cluster-forgets-nothing, layout-owned-cleanup, selfhosted-keeps-signins, read-alongside-plus-retry, do-less-alternative; raised: degraded review) @ dd9d36f}

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	79.41%	14532 / 18299
🔵	Statements	79.36%	15423 / 19433
🔵	Functions	74.81%	3879 / 5185
🔵	Branches	74.05%	11317 / 15282

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/features/auth/store/authStore.ts	91.4%	82.93%	91.35%	91.86%	117, 203-214, 219-222, 270, 291, 312-323, 331, 336-339, 441-444, 814, 819, 896, 920
src/features/cluster/ClusterHome.tsx	43.02%	47.57%	40%	44.57%	46-49, 53, 63, 67, 73-85, 102-112, 117-119, 123-134, 234-376, 441-448
src/features/cluster/ClusterLayout.tsx	100%	100%	100%	100%
src/features/cluster/redirectAwayFromDeletedCluster.ts	100%	100%	100%	100%
src/features/cluster/terminatedClusterSignIns.ts	100%	75%	100%	100%
src/features/clusters/mutations/terminateCluster.ts	83.33%	66.66%	66.66%	83.33%	38-39
src/features/instance/instanceLayoutRoute.ts	86.11%	82.35%	75%	88.57%	22-23, 134-135

Generated in workflow #2369 for commit dd9d36f by the Vitest Coverage Report Action

[gemini-code-assist]

Code Review

This pull request ensures that bookmarks or deep links to in-cluster pages (such as apps, databases, APIs, operations, status, logs, and config) for a terminated cluster are redirected to the overview page before any authentication checks or sign-in restorations occur. This prevents the application from attempting to connect to a torn-down host using remembered credentials. The changes include updating the design documentation, integrating the redirect guard into checkClusterInstanceAuthenticationBeforeLoad, and adding comprehensive unit tests to verify the redirection behavior for both direct page loads and deep links. No review comments were provided, so there is no feedback to address.