dda0a3d2df
apiHeadersInterceptor injected @marketplaces/auth's AuthService to attach a WebSessionID header. AuthService's own constructor makes a synchronous GET /users/sessions/:id call to verify a persisted session, which runs through this exact interceptor - Angular throws NG0200 (circular dependency) mid-construction, silently swallowed by the package's catchError(() => of(null)), read as "session invalid," and the cookie gets cleared on every single page load. This is what was gating the architecture-governance e2e job on Gitea (3 checkout tests failing on a disabled QR button). Session-check requests are the identity mechanism itself and never needed that header - skip AuthService injection for them instead. Also fixes mock-data.interceptor's session-check mock, which required 3 polls before reporting an id active with no way to represent a returning session with an already-valid cookie - not the actual trigger for this bug (useMockData is false in the dev config CI uses), but a real gap in the mock's fidelity worth closing while in this file.