fix(nav): Add timeout recovery to prevent navigation hang after login

When router.push() is called during login redirect, it can succeed at the
JavaScript level while the underlying Next.js App Router fails to update
its internal state. This causes usePathname() to remain stale, leaving
the navigation machine stuck in a redirecting state with no escape path.

Root cause analysis:
- router.push('/') returns successfully (no error thrown)
- RSC request completes with HTTP 200
- But usePathname() never updates from '/login'
- The always guards can't fire because pathname hasn't changed
- CLEAR_SIDE_EFFECT only cleared context but had no target transition

This was observed specifically on cold sessions where:
1. Initial page load had expired tokens
2. Token refresh was attempted and failed (401)
3. User logged in successfully
4. Navigation to post-login destination hung

The App Router's internal navigation state appears to get corrupted when
there's been a failed auth cycle before the login, possibly due to:
- Concurrent RSC requests from the failed refresh interfering
- React Suspense boundary state not propagating correctly
- Cookie timing issues between refresh failure and login success

The fix adds a recovery transition: when CLEAR_SIDE_EFFECT fires with
reason='timeout', the machine now transitions to 'evaluating' instead of
staying stuck. This allows it to re-evaluate conditions and retry the
navigation, or at minimum reach a stable state the user can interact with.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: jhf

app/src/atoms/navigation-machine.ts

@@ -262,15 +262,28 @@ export const navigationMachine = setup({
               handleSideEffectTimeout(context, event, 'redirectingToLogin')
             ),
           },
-          CLEAR_SIDE_EFFECT: {
-            // Clear sideEffect (called by polling for TOO FAST/TOO SLOW detection)
-            actions: assign(({ context }) => ({
-              ...context,
-              sideEffect: undefined,
-              sideEffectStartTime: undefined,
-              sideEffectStartPathname: undefined,
-            })),
-          }
+          CLEAR_SIDE_EFFECT: [
+            {
+              // TIMEOUT RECOVERY: Transition to evaluating to retry navigation.
+              target: 'evaluating',
+              guard: ({ event }) => event.reason === 'timeout',
+              actions: assign(({ context }) => ({
+                ...context,
+                sideEffect: undefined,
+                sideEffectStartTime: undefined,
+                sideEffectStartPathname: undefined,
+              })),
+            },
+            {
+              // FAST DETECTION: Just clear sideEffect, let always guards handle transition.
+              actions: assign(({ context }) => ({
+                ...context,
+                sideEffect: undefined,
+                sideEffectStartTime: undefined,
+                sideEffectStartPathname: undefined,
+              })),
+            },
+          ],
         },
       always: [
         {
@@ -309,15 +322,28 @@ export const navigationMachine = setup({
               handleSideEffectTimeout(context, event, 'redirectingToSetup')
             ),
           },
-          CLEAR_SIDE_EFFECT: {
-            // Clear sideEffect (called by polling for TOO FAST/TOO SLOW detection)
-            actions: assign(({ context }) => ({
-              ...context,
-              sideEffect: undefined,
-              sideEffectStartTime: undefined,
-              sideEffectStartPathname: undefined,
-            })),
-          }
+          CLEAR_SIDE_EFFECT: [
+            {
+              // TIMEOUT RECOVERY: Transition to evaluating to retry navigation.
+              target: 'evaluating',
+              guard: ({ event }) => event.reason === 'timeout',
+              actions: assign(({ context }) => ({
+                ...context,
+                sideEffect: undefined,
+                sideEffectStartTime: undefined,
+                sideEffectStartPathname: undefined,
+              })),
+            },
+            {
+              // FAST DETECTION: Just clear sideEffect, let always guards handle transition.
+              actions: assign(({ context }) => ({
+                ...context,
+                sideEffect: undefined,
+                sideEffectStartTime: undefined,
+                sideEffectStartPathname: undefined,
+              })),
+            },
+          ],
         },
       always: [
         {
@@ -475,15 +501,31 @@ export const navigationMachine = setup({
             handleSideEffectTimeout(context, event, 'redirectingFromLogin')
           ),
         },
-        CLEAR_SIDE_EFFECT: {
-          // Clear sideEffect (called by polling for TOO FAST/TOO SLOW detection)
-          actions: assign(({ context }) => ({
-            ...context,
-            sideEffect: undefined,
-            sideEffectStartTime: undefined,
-            sideEffectStartPathname: undefined,
-          })),
-        },
+        CLEAR_SIDE_EFFECT: [
+          {
+            // TIMEOUT RECOVERY: If navigation timed out, transition to evaluating to retry.
+            // This prevents the machine from getting stuck when router.push() succeeds
+            // but the pathname doesn't update (e.g., due to Next.js App Router issues).
+            target: 'evaluating',
+            guard: ({ event }) => event.reason === 'timeout',
+            actions: assign(({ context }) => ({
+              ...context,
+              sideEffect: undefined,
+              sideEffectStartTime: undefined,
+              sideEffectStartPathname: undefined,
+            })),
+          },
+          {
+            // FAST DETECTION: Navigation completed quickly, just clear sideEffect.
+            // The always guards will handle the transition to idle.
+            actions: assign(({ context }) => ({
+              ...context,
+              sideEffect: undefined,
+              sideEffectStartTime: undefined,
+              sideEffectStartPathname: undefined,
+            })),
+          },
+        ],
       },
       always: [
         {