fix(spa): guard empty session code before hydrate/start

frontend/src/spa/vertical-slice.ts

@@ -52,6 +52,12 @@ export function createVerticalSliceController(
     const fallbackCode = normalizeCode(state.sessionCode || persistedContext?.sessionCode || '');
     state.sessionCode = normalizedRequestedCode || fallbackCode;
 
+    if (!state.sessionCode) {
+      state.loadingSession = false;
+      state.errorMessage = 'Session-kode mangler.';
+      return { ...state };
+    }
+
     const result = await api.getSession(state.sessionCode);
     state.loadingSession = false;
 
@@ -106,6 +112,12 @@ export function createVerticalSliceController(
     const fallbackCode = normalizeCode(state.sessionCode || persistedContext?.sessionCode || '');
     const codeToUse = normalizedRequestedCode || fallbackCode;
 
+    if (!codeToUse) {
+      state.startRoundState = 'error';
+      state.errorMessage = 'Session-kode mangler.';
+      return { ...state };
+    }
+
     const start = await api.startRound(codeToUse, { category_slug: categorySlug });
     if (!start.ok) {
       state.startRoundState = 'error';

frontend/tests/vertical-slice.test.ts

@@ -189,6 +189,30 @@ describe('vertical slice controller: lobby -> join -> start round', () => {
     expect(state.errorMessage).toContain('Kunne ikke starte runden');
   });
 
+  it('shows local validation error and avoids API call when hydrating without any session code', async () => {
+    const api = makeApiMock();
+    const controller = createVerticalSliceController(api, makeSessionContextStore(null));
+
+    await controller.hydrateLobby('   ');
+
+    const state = controller.getState();
+    expect(state.errorMessage).toBe('Session-kode mangler.');
+    expect(state.loadingSession).toBe(false);
+    expect(api.getSession).not.toHaveBeenCalled();
+  });
+
+  it('shows local validation error and avoids API call when starting round without any session code', async () => {
+    const api = makeApiMock();
+    const controller = createVerticalSliceController(api, makeSessionContextStore(null));
+
+    await controller.startRound('   ', 'history');
+
+    const state = controller.getState();
+    expect(state.startRoundState).toBe('error');
+    expect(state.errorMessage).toBe('Session-kode mangler.');
+    expect(api.startRound).not.toHaveBeenCalled();
+  });
+
   it('uses joined session code when starting round without a reload', async () => {
     const api = makeApiMock();
     const controller = createVerticalSliceController(api);