[diegosouzapw]

Closes #12709

Root cause

/api/settings/database and /api/settings/import-json are intentionally listed in
ALWAYS_PROTECTED_API_PATHS (src/server/authz/routeGuard.ts:117-141), a deliberate hardening
fix for GHSA-mghq-58h3-qcqj and GHSA-v7g9-7f55-5g46. A guest/anonymous session (fresh install,
setup wizard skipped, no admin password configured) correctly gets a 401 AUTH_001 from both
endpoints — that gate is intentional and is not touched by this PR.

The actual bug was client-side: SystemStorageTab.tsx (Settings → General) fetched
/api/settings/database on mount and collapsed any non-2xx response, including this 401, to
null with zero error state. Every database-settings render helper is gated on
if (dbSettingsLoading || !dbSettings) return null;, so the whole section silently disappeared
instead of showing any explanation — matching the reporter's "Failed to load settings"
description. The JSON-import POST path (handleJsonSelected) had the same blind spot: a guest
401 just showed the generic "Failed to import JSON" text.

Fix

• Extracted the fetch/401-detection logic into a new module,
  src/app/(dashboard)/dashboard/settings/components/systemStorageAuth.tsx
  (fetchDatabaseSettingsData, isAuthRequiredResponse, AuthRequiredBanner) — SystemStorageTab.tsx
  is at its frozen file-size baseline (1597 LOC), so new logic had to live in a new file rather
  than growing the frozen one.
• SystemStorageTab.tsx now tracks dbSettingsAuthRequired and renders an explicit
  "Authentication required" banner (with a sign-in CTA) in place of the silently-blank section.
• The JSON-import failure path now shows a dedicated "authentication required" message
  (jsonImportAuthRequired) instead of the generic import-failed text when the response is the
  intentional 401.
• Added the corresponding en.json strings (databaseSettingsAuthRequiredTitle/Body/Cta,
  jsonImportAuthRequired).

ALWAYS_PROTECTED_API_PATHS, isAlwaysProtectedPath, and managementPolicy's handling of these
two routes were not modified — the 401 stays intentional and correct.

Regression test (TDD, Hard Rule #18)

tests/unit/ui/system-storage-tab-guest-401-12709.test.tsx mounts the real SystemStorageTab
component with fetch mocked to return the exact 401/AUTH_001 payload from the issue for
/api/settings/database, then asserts the rendered text mentions auth/login/401/unauthorized.

• RED (confirmed against the unfixed component, base release/v3.8.51 content):
  npx vitest run tests/unit/ui/system-storage-tab-guest-401-12709.test.tsx →
  AssertionError: expected false to be true at the mentionsAuth assertion.
• GREEN (with the fix applied): same command → 1 passed.

Gates run

• node scripts/check/check-file-size.mjs → OK (138 frozen files, cap 1200 for new files;
  SystemStorageTab.tsx stays exactly at its 1597-line baseline)
• node scripts/check/check-complexity.mjs → OK (2798 violations vs baseline 3218)
• node scripts/check/check-cognitive-complexity.mjs → OK (1265 violations vs baseline 1437)
• npm run typecheck:core → clean
• npm run check:dashboard-typecheck → OK, 206 pre-existing errors, all within frozen baseline
  (no new errors in the touched files)
• npx eslint --suppressions-location config/quality/eslint-suppressions.json <changed files> →
  clean
• npx vitest run tests/unit/ui/system-storage-tab-guest-401-12709.test.tsx → 1 passed (new
  regression test)
• Existing area tests re-run and still green: tests/unit/settings-ui-layout-static.test.ts,
  tests/unit/dashboard-localization-contract.test.ts,
  tests/unit/quota-card-grid-mobile-7072.test.ts (23/23 passed via
  node --import tsx/esm --test)
• node scripts/check/check-changelog-integrity.mjs → OK

⚠️ base-red inherited: #12732 — unit #12058, integration codex-cache, package-artifact, tarball-smoke, agent-skills-sync