Signed-out bounces to sign-in replace the page (#503)

ddiff --git a/public/js/my/profile.js b/public/js/my/profile.js
iindex 28e4d951..82f9dcbf 100644
---- a/public/js/my/profile.js
++++ b/public/js/my/profile.js
@@@ -10,7 +10,9 @@ async function loadUser() {
      await _bootstrapFromCookie();
      const authToken = getAuthToken();
      const anonToken = getAnonToken();
--    if (!authToken && !anonToken) { window.location.href = '/login'; return; }
++    // A replace, not a new history entry: Back should not land on a page that bounces again, and a replace navigation
++    // skips the cross-document view transition the sign-in page cannot finish (openvibe-shared 4.88.1).
++    if (!authToken && !anonToken) { window.location.replace('/login'); return; }
      try {
          if (isAnonSession()) {
              const data = await anonFetch('/api/auth/anon/' + encodeURIComponent(anonToken));
@@@ -74,7 +76,7 @@ async function loadUser() {
                      if (r.ok) { const d = await r.json(); if (d.token) { localStorage.setItem('ov_token', d.token); document.cookie = `ov_token=${d.token};path=/;max-age=${60*60*24*90};SameSite=Lax${location.protocol === 'https:' ? ';Secure' : ''}`; location.reload(); return; } }
                  } catch { /* fall through */ }
              }
--            window.location.href = '/login?return=' + encodeURIComponent(window.location.pathname);
++            window.location.replace('/login?return=' + encodeURIComponent(window.location.pathname));
              return;
          }
          showAccountLoadError(err);
ddiff --git a/test/signin-bounce-replace.test.js b/test/signin-bounce-replace.test.js
nnew file mode 100644
iindex 00000000..c6a1983e
---- /dev/null
++++ b/test/signin-bounce-replace.test.js
@@@ -0,0 +1,12 @@
++'use strict';
++// A signed-out visitor on the account hub is sent to sign-in with location.replace: Back does not land on a page that
++// bounces again, and a replace navigation skips the cross-document view transition the sign-in page cannot finish.
++const assert = require('assert');
++const fs = require('fs');
++const path = require('path');
++
++const src = fs.readFileSync(path.join(__dirname, '..', 'public', 'js', 'my', 'profile.js'), 'utf8');
++assert.match(src, /if \(!authToken && !anonToken\) \{ window\.location\.replace\('\/login'\); return; \}/);
++assert.match(src, /window\.location\.replace\('\/login\?return=' \+ encodeURIComponent\(window\.location\.pathname\)\);/);
++assert.ok(!/window\.location\.href = '\/login'/.test(src), 'no signed-out bounce adds a history entry');
++console.log('sign-in bounce: all checks passed');