Merge remote-tracking branch 'origin/WorkflowChange' into feature/exam-attempt-domain

# Conflicts:
#	apps/portal/src/app/features/exams/pages/ExamsPage/columns.tsx
#	apps/portal/src/app/features/exams/pages/ExamsPage/index.tsx
#	libs/api/src/lib/features/licensing/licensing.helpers.ts
#	libs/auth/src/lib/components/AuthBootstrap.tsx

libs/api/src/lib/base-api/base-query-with-reauth.ts

@@ -42,8 +42,13 @@ export const baseQueryWithReauth: BaseQueryFn<
       try {
         await _onTokenExpired();
         result = await baseQuery(args, api, extraOptions);
-      } catch {
-        _onAuthFailure?.();
+      } catch (err) {
+        // Only a rejected refresh token ends the session. A network blip or a
+        // 5xx leaves the original 401 for the screen to report, rather than
+        // throwing the user out of a session that is still valid.
+        if ((err as { sessionExpired?: boolean })?.sessionExpired) {
+          _onAuthFailure?.();
+        }
       }
     } else {
       _onAuthFailure?.();

libs/api/src/lib/base-api/download.ts

@@ -41,3 +41,57 @@ export async function openAuthedDocument(
   // Revoking immediately would race the new tab's load.
   setTimeout(() => URL.revokeObjectURL(url), 60_000);
 }
+
+/**
+ * Downloads an authenticated endpoint straight to a file.
+ *
+ * Same reason as `openAuthedDocument` for bypassing RTK Query — `fetchBaseQuery`
+ * would parse a CSV body as JSON — but a spreadsheet is something you save, not
+ * something the browser can display, so this always takes the anchor path.
+ *
+ * The server names the file via `Content-Disposition`, and the API's CORS
+ * config exposes that header along with `X-Total-Rows` and `X-Truncated`; those
+ * two are returned so a caller can say when an export was cut short instead of
+ * handing over a silently partial file.
+ */
+export async function downloadAuthedFile(
+  path: string,
+  fallbackName: string,
+): Promise<{ rowCount: number | null; truncated: boolean }> {
+  const token = resolveTokenFromStorage();
+  const response = await fetch(`${BASE_API_URL}${path}`, {
+    headers: token ? { Authorization: `Bearer ${token}` } : {},
+  });
+  if (!response.ok) {
+    let message = `${response.status}`;
+    try {
+      const body = await response.json();
+      message = body?.message ?? message;
+    } catch {
+      /* non-JSON error body — the status is all we have */
+    }
+    throw new Error(message);
+  }
+
+  const blob = await response.blob();
+  const url = URL.createObjectURL(blob);
+  const anchor = document.createElement('a');
+  anchor.href = url;
+  anchor.download = filenameFrom(response.headers) ?? fallbackName;
+  anchor.click();
+  setTimeout(() => URL.revokeObjectURL(url), 60_000);
+
+  const rows = response.headers.get('X-Total-Rows');
+  return {
+    rowCount: rows === null ? null : Number(rows),
+    truncated: response.headers.get('X-Truncated') === 'true',
+  };
+}
+
+/** `attachment; filename="vessel-register-2026-08-18.csv"` → the file name. */
+function filenameFrom(headers: Headers): string | null {
+  const disposition = headers.get('Content-Disposition');
+  if (!disposition) return null;
+  const match = /filename="?([^";]+)"?/.exec(disposition);
+  return match?.[1] ?? null;
+}

libs/api/src/lib/base-api/tagTypes.ts

@@ -1 +1 @@
-export const tagTypes = ["ProfessionApi"];
+export const tagTypes = ["ProfessionApi", "NumberFormatApi"];