[Studio][Bug] Synchronize browser auth state after policy and password changes

## Problem\nDisabling login protection leaves a stale Reader role in browser state, continuing to disable writes. Changing the current user's password revokes the server session but leaves the browser visually authenticated until a later 401.\n\n## Scope\nClear or refresh the client auth store on policy changes and self-password changes, with UI regression tests.