The /stop route used browser-only authSession(), so the desktop's vibn_sk_
key got a 401. The desktop treats any 401 as session-expired and signs the
user out (kicking them to the login page on Stop). Use requireWorkspacePrincipal
like the sibling create/get routes.