feat: enhance document import functionality and runtime configuration

- Added support for watching local folders in the EmbeddedImportMenu, including a new FolderSync icon.
- Introduced onFolderWatched callback to handle folder watch success.
- Updated runtime configuration hooks to allow optional access outside the RuntimeConfigProvider.
- Improved error handling in ZeroProvider for unauthorized access scenarios.
- Refactored base API service to manage desktop authentication more effectively.

surfsense_web/components/providers/ZeroProvider.tsx

@@ -35,6 +35,13 @@ async function fetchZeroContext(isDesktop: boolean): Promise<LoadedZeroContext |
 	const response = await authenticatedFetch(buildBackendUrl("/zero/context"), {
 		skipAuthRedirect: true,
 	});
+	if (response.status === 401) {
+		// Auth is dead (refresh already failed inside authenticatedFetch). This
+		// provider gates the whole app tree, so nothing below it (e.g.
+		// DashboardShell) can run its own redirect — do it here.
+		handleUnauthorized();
+		return null;
+	}
 	if (!response.ok) return null;
 
 	return {
@@ -234,6 +241,12 @@ function ZeroClientProvider({
 function WebZeroProvider({ children }: { children: React.ReactNode }) {
 	const session = useSession();
 
+	// Same reasoning as fetchZeroContext: this provider blocks the whole tree,
+	// so the login redirect must happen here, not in a child that never mounts.
+	useEffect(() => {
+		if (session.status === "unauthenticated") handleUnauthorized();
+	}, [session.status]);
+
 	if (session.status !== "authenticated") {
 		return null;
 	}

surfsense_web/components/providers/runtime-config.tsx

@@ -31,6 +31,11 @@ export function useRuntimeConfig() {
 	return context;
 }
 
+/** For components that may render outside RuntimeConfigProvider (e.g. anonymous /free pages). */
+export function useOptionalRuntimeConfig(): RuntimeConfigValue | null {
+	return useContext(RuntimeConfigContext);
+}
+
 export function useIsLocalAuth() {
 	return useRuntimeConfig().authType === "LOCAL";
 }