UnauthorizedHandler

Invoked when any authenticated call comes back 401 (token expired/revoked). The core:data SessionManager binds this to clear the stored token and flip the shell into re-login. Kept as a seam (like TokenProvider) so core:network needn't depend on core:data. Default = no-op.

Cycle note: the client resolves this lazily (only when a 401 actually fires), so the DI graph client → handler → AuthApi → client has no construction-time edge back to the client.