fix(chart): keep subject-scoped failures visible and follow the new routes

A 401 for the current person was stored, then hidden because the subject stamp only happened on success. Session, report, and birth contracts now follow the subject query and the shared birth lookup. Admin reset fixtures can no longer insert a retired self mirror.

frontend/src/lib/secondary-page-data.ts

@@ -255,7 +255,10 @@ const ephemerisCache = createMemoryCache<EphemerisPageSnapshot>(async () => {
     headers: { Accept: "application/json" },
     cache: "no-store",
   });
-  if (response.status === 401) return { kind: "unauthorized" };
+  if (response.status === 401) {
+    ephemerisSubject = subjectId;
+    return { kind: "unauthorized" };
+  }
   const json: unknown = await response.json().catch(() => null);
   const payload = parseEphemerisOkResponse(json);
   if (!payload) throw new Error("ephemeris_page_bad_payload");
@@ -304,8 +307,14 @@ const reportsCache = createMemoryCache<ReportsPageSnapshot>(async () => {
   });
   const json: unknown = await response.json().catch(() => null);
   if (readCurrentSubjectId() !== subjectId) throw new Error("reports_subject_changed");
-  if (response.status === 401) return { kind: "unauthorized" };
-  if (!response.ok) return { kind: "error", reports: [] };
+  if (response.status === 401) {
+    reportsSubject = subjectId;
+    return { kind: "unauthorized" };
+  }
+  if (!response.ok) {
+    reportsSubject = subjectId;
+    return { kind: "error", reports: [] };
+  }
   reportsSubject = subjectId;
   return { kind: "ready", reports: readReports(json) };
 });