fix: wait for auth session before redirecting

[AshanEason]

Type of changes

• Fix

Purpose

• Prevent authenticated users from being redirected to /login while the initial session request is still loading.
• Separate the auth guard hotfix from the unrelated model-selection and environment changes currently included in Fix-Auth-System #39.

Additional Information

Root Cause

RequireAuth treated the initial isAuthenticated: false value as a confirmed unauthenticated state before the asynchronous session query had completed. This caused an authenticated user to be redirected to /login during application startup.

Changes

• Wait for isLoading to finish before redirecting an unauthenticated user.
• Use history replacement when redirecting to /login.
• Keep protected content hidden while the authentication state is loading.

Difference from #39

	#40	#39
Purpose	Auth guard hotfix only	Auth fix mixed with model-selection, CI, environment, and documentation changes
Commits	1	8
Files	src/shared/auth/RequireAuth.tsx only	17 files
Relationship to #38	Independent of #38	Contains all commits from #38
Review strategy	Can be reviewed and merged as a focused hotfix	Should not be merged as-is because it combines multiple scopes

#40 intentionally excludes:

• The PostHog-gated model selector and chat request changes from feat: add PostHog-gated model switching to chat #38.
• pnpm and workflow changes.
• .env.development, example.env, and README changes.

Validation

• git diff --check
• pnpm format
• pnpm typecheck
• pnpm lint
• pnpm build
• GitHub Actions:
  • Prettier passed.
  • ESLint passed.
  • TypeScript passed.
  • Docker image build passed.
  • Snapshot deployment passed.

Preview Smoke Test

• An unauthenticated visit to / redirects to /login.
• The login page loads without browser console warnings or errors.
• The session request and CORS preflight accept the PR preview origin.
• The Google OAuth start endpoint accepts the PR preview redirect and responds with a redirect to Google.
• Authenticated refresh and the full OAuth callback remain a manual check because the test browser has no signed-in session.

Follow-up and Merge Order

1. Complete the authenticated refresh and full OAuth callback smoke test for fix: wait for auth session before redirecting #40.
2. Mark fix: wait for auth session before redirecting #40 ready for review and merge fix: wait for auth session before redirecting #40 into main first.
3. Continue feat: add PostHog-gated model switching to chat #38 as the independent model-selection PR. Update it with the latest main, address its feature-flag readiness behavior, rerun its checks, and merge it only after its own review.
4. Do not merge Fix-Auth-System #39. After fix: wait for auth session before redirecting #40 is merged, close Fix-Auth-System #39 as superseded once any remaining environment/documentation changes have been evaluated.
5. If the local development environment defaults from Fix-Auth-System #39 are still wanted, move them into a separate PR from main and document overrides using .env.development.local.

The repository currently has no automated auth regression-test setup, so this PR keeps the hotfix focused and records the manual verification requirement above.