feat: thread authenticated user id through chat, feedback, and ADK

[nonumpa]

Implements #47 on top of #25.

Summary

• ADK endpoints now receive the real Cofacts user id instead of 'anonymous', so per-user side panels and session lists work.
• Langfuse feedback scores are tagged with the user id (via metadata.userId, since ScoreBody has no first-class userId field).
• The chat input is replaced with a login CTA when no user is signed in, on both the landing page and inside an existing session.

Changes

• src/server/adkUser.ts: new resolveAdkUserIdOrThrow() reads the cofacts_session cookie via cofactsExec, returns user.id, throws UnauthorizedError when unauthenticated.
• src/lib/chatSessions.functions.ts, src/routes/api/run-sse.ts: drop the hardcoded ADK_USER_ID, resolve per-request. The SSE proxy returns 401 JSON on unauthenticated callers.
• src/components/FeedbackButtons.tsx: pass metadata: { userId } to all three langfuse.score() calls.
• src/components/LoginPrompt.tsx (new): shared login CTA shown in place of ChatInput.
• src/components/ChatArea.tsx, src/routes/_app/index.tsx: gate chat input behind useAuth().user.

Verification

• tsc --noEmit: clean
• eslint on changed files: clean (one pre-existing warning in chatSessions.functions.ts:26 left untouched)
• vitest run: 47/47 pass
• vite build: success

Notes

• Stacks on feat(auth): BFF auth with HttpOnly cookie + SSR #25 (feature/bff-auth). Will rebase onto master once feat(auth): BFF auth with HttpOnly cookie + SSR #25 lands.
• No new env vars.

[gemini-code-assist]

Code Review

This pull request implements user authentication by replacing the hardcoded anonymous user ID with dynamic session-based resolution. It introduces a new LoginPrompt component and updates the ChatArea and landing page to conditionally render inputs based on the user's login status. Additionally, server-side functions and feedback metadata now include the authenticated user's ID. A review comment identifies a discrepancy in src/server/adkUser.ts where the code throws a custom error instead of a Response object, which may prevent TanStack Start from correctly propagating a 401 status code to the client.

[gemini-code-assist]

The comment states that this helper throws a "401-shaped Response", but the implementation on lines 19-21 throws a custom UnauthorizedError object.

In TanStack Start, throwing a standard Error in a createServerFn (like those in chatSessions.functions.ts) typically results in a 500 Internal Server Error on the client side. To allow the framework to propagate a specific HTTP status code (like 401) automatically to the browser, you should throw a Response object instead.

If you prefer using the custom error class for manual handling (as seen in run-sse.ts), please update the comment to reflect that an Error is thrown rather than a Response.