Replace hard redirects with client-side navigation

[amrtgaber]

Login, logout, and OAuth callbacks use window.location.href (full page reload) due to a race condition between auth state updates and TanStack Router's beforeLoad context. Investigate:

• router.invalidate() after auth state changes
• Ref-based context passing
• Waiting for re-render before navigating

Goal: smooth client-side transitions instead of full reloads.

[amrtgaber]

Resolved by #45 (the implementation, tracked separately as #43). All six auth-flow window.location.href call sites are now client-side useNavigate transitions; the documented "race with onUnauthorized" did not manifest with the await auth.checkAuth() + await navigate() pattern.