* fix(workspace): recover from stale sessions instead of blank loader after impersonation
* fix(workspace): gate stale-session recovery on auth state and surface failed sign-out
* fix(workspace): proceed with redirect when session query errors but cached identity exists