fix: add auth guard to root layout with setup/login redirects

Layout now checks auth on mount and redirects:
- No users exist -> /setup
- Not authenticated -> /login
- Shows loading state while checking

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/routes/+layout.svelte

@@ -1,10 +1,31 @@
-<script>
+<script lang="ts">
 	import '../app.css';
 	import { initTheme } from '$lib/theme.svelte.ts';
-
+	import { checkAuth, isLoading, isAuthenticated, getNeedsSetup } from '$lib/auth.svelte.ts';
+	import { onMount } from 'svelte';
 	let { children } = $props();
+	let mounted = $state(false);
 
-	initTheme();
+	onMount(() => {
+		initTheme();
+		checkAuth().then(() => {
+			mounted = true;
+			const path = window.location.pathname;
+			const publicPaths = ['/login', '/setup'];
+
+			if (getNeedsSetup() && path !== '/setup') {
+				window.location.href = '/setup';
+			} else if (!getNeedsSetup() && !isAuthenticated() && !publicPaths.includes(path)) {
+				window.location.href = '/login';
+			}
+		});
+	});
 </script>
 
-{@render children()}
+{#if !mounted || isLoading()}
+	<div class="min-h-screen flex items-center justify-center">
+		<p class="text-muted-foreground">Loading...</p>
+	</div>
+{:else}
+	{@render children()}
+{/if}