provideRouter redirectUnauthorizedRequest with least-privilege role boundary and token expiration

The configuration goal is to use provideRouter with redirectUnauthorizedRequest enabled (Angular 15+) for unauthenticated navigation, while also enforcing least-privilege role checks and handling expired credentials without exposing unauthorized UI.

The router option auto-redirects when guard protection triggers, but token expiration detection is not built in and depends on developer-managed AuthService state. Role-based enforcement still requires custom CanActivate guards with role arrays, and guard return values (boolean, UrlTree, Promise) interact with the redirect option. Navigation guards can also fire before HTTP interceptors complete token validation, which complicates the ordering of refresh attempts and login rendering.

Is redirectUnauthorizedRequest intended to cover only unauthenticated access, or should insufficient role privilege also flow through it? When the option is enabled, should a role guard return a UrlTree for unauthorized roles or let the router redirect handle it? What configuration boundary distinguishes an expired-token redirect from a missing-credentials redirect?