Handle session expiration correctly and fix icon CORS errors

- Detect CORS/redirect errors from Authentik and interpret them as
  "no session" instead of generic error
- When session expires, Authentik returns 302 redirect to login which
  causes CORS error in fetch requests
- Add /api/_nuxt_icon/ to public routes to prevent icon load failures
  after logout

This fixes the issue where logout in Authentik showed "Error" instead
of "Sin Sesión" when checking session status.

docker-compose.yml

@@ -24,7 +24,7 @@ services:
       - "traefik.http.services.${APP_NAME}.loadbalancer.server.port=3000"
 
       # Router 1: Public PWA resources (no auth) - Higher priority
-      - "traefik.http.routers.${APP_NAME}-public.rule=Host(`${APP_DOMAIN}`) && (PathPrefix(`/manifest.webmanifest`) || PathPrefix(`/sw.js`) || PathPrefix(`/workbox-`) || PathPrefix(`/icon-`) || PathPrefix(`/apple-touch-icon`) || PathPrefix(`/favicon.ico`) || PathPrefix(`/robots.txt`))"
+      - "traefik.http.routers.${APP_NAME}-public.rule=Host(`${APP_DOMAIN}`) && (PathPrefix(`/manifest.webmanifest`) || PathPrefix(`/sw.js`) || PathPrefix(`/workbox-`) || PathPrefix(`/icon-`) || PathPrefix(`/apple-touch-icon`) || PathPrefix(`/favicon.ico`) || PathPrefix(`/robots.txt`) || PathPrefix(`/api/_nuxt_icon/`))"
       - "traefik.http.routers.${APP_NAME}-public.entrypoints=websecure"
       - "traefik.http.routers.${APP_NAME}-public.tls.certresolver=letsencrypt"
       - "traefik.http.routers.${APP_NAME}-public.priority=100"