The initial authorization probe called the nonexistent /api/v1/children
and treated every non-403 outcome as success, so a 404 rendered the
admin shell. Probe the admin plane's GET /api/v1/admin/ping instead and
enter the shell only on a 2xx: 403 shows the refusal, 401 keeps the
login flow, and any other status or network failure shows a new
probe-error screen with Retry and Sign out.
Task: f50338c8-8b48-4e3d-9064-e20d9b32fe34
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>