fix: allow unauthenticated access to public review pages

The 401 handler in api.js was redirecting to /login on ALL pages,
including public review/approval pages, defeating their purpose.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

client/src/utils/api.js

@@ -37,8 +37,10 @@ const normalize = (data) => {
 const handleResponse = async (r, label) => {
   if (!r.ok) {
     if (r.status === 401) {
-      // Unauthorized (not logged in) - redirect to login if not already there
-      if (!window.location.pathname.includes('/login')) {
+      // Unauthorized — redirect to login unless on a public page
+      const p = window.location.pathname;
+      const isPublic = p.startsWith('/review/') || p.startsWith('/review-post/') || p.startsWith('/submit-issue') || p.startsWith('/track/');
+      if (!p.includes('/login') && !isPublic) {
         window.location.href = '/login';
       }
     }