fix(web): simplify first-time token sign-in

web/src/hooks/use-session-auth.ts

@@ -18,8 +18,11 @@ function persistToken(token: string | null) {
 }
 
 function normalizeAuthError(message: string) {
-  if (message.includes("missing bearer token") || message.includes("invalid bearer token")) {
-    return "Authentication failed. Enter the ADMIN_TOKEN configured in server/.env.";
+  if (message.includes("invalid bearer token")) {
+    return "Incorrect token. Please try again.";
+  }
+  if (message.includes("missing bearer token")) {
+    return "Enter your admin token.";
   }
   return message;
 }
@@ -43,10 +46,10 @@ export function useSessionAuth() {
     persistToken(tokenCandidate);
   };
 
-  const handleAuthFailure = (message: string) => {
+  const handleAuthFailure = (message: string | null) => {
     setIsAuthenticated(false);
     setAuthMode(null);
-    setAuthError(normalizeAuthError(message));
+    setAuthError(message ? normalizeAuthError(message) : null);
     setAuthToken(null);
     persistToken(null);
   };
@@ -81,7 +84,8 @@ export function useSessionAuth() {
         await completeSessionCheck(token);
       } catch (err) {
         const message = err instanceof Error ? err.message : String(err);
-        handleAuthFailure(message);
+        // A first visit without a token is an invitation to sign in, not a failed attempt.
+        handleAuthFailure(!token && message.includes("missing bearer token") ? null : message);
       } finally {
         setIsCheckingSession(false);
       }