phase 7: auth flow UI (email-code login + session resume + revocation)

Implements ui/PLAN.md Phase 7 end-to-end:

- /login two-step form (email -> code) over the gateway public REST
  surface; /lobby placeholder issues the first authenticated
  user.account.get and renders the decoded display name.
- SessionStore (Svelte 5 runes) with loading / unsupported / anonymous /
  authenticated states; layout-level route guard, browser-not-supported
  blocker, and a minimal SubscribeEvents revocation watcher that closes
  the active client within 1s on a clean stream end or
  Unauthenticated.
- VITE_GATEWAY_BASE_URL + VITE_GATEWAY_RESPONSE_PUBLIC_KEY config plus
  AuthError taxonomy in api/auth.ts.
- Vitest (auth-api, session-store, login-page) and Playwright e2e
  (auth-flow.spec.ts) on the four configured projects, with a fixture
  Ed25519 keypair forging Connect-Web JSON responses.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/README.md

@@ -63,21 +63,26 @@ ui/
 ├── README.md               this file
 ├── buf.gen.yaml            local-plugin TS Protobuf-ES generator
 ├── docs/                    topic-based design notes
+│   ├── auth-flow.md         email-code login, session store, revocation
 │   ├── storage.md           web KeyStore/Cache, IDB schema, baseline
 │   ├── testing.md           per-PR / release test tiers
 │   └── wasm-toolchain.md    TinyGo build, JSDOM loading, bundle budget
 ├── core/                    ui/core Go module (canonical bytes, keypair)
 ├── wasm/                    TinyGo entry point exposing Core to JS
 └── frontend/                SvelteKit / Vite source
-    ├── src/api/             GalaxyClient + typed Connect client + session
+    ├── src/api/             GalaxyClient + typed Connect client + auth + session
+    ├── src/lib/             env config, session store, revocation watcher
     ├── src/platform/core/   Core interface + WasmCore adapter
     ├── src/platform/store/  KeyStore/Cache interfaces + web adapter
     ├── src/proto/           generated Protobuf-ES + Connect descriptors
+    ├── src/routes/          SvelteKit routes (/, /login, /lobby)
     └── static/              core.wasm + wasm_exec.js (committed artefacts)
 ```
 
 Linked topic docs:
 
+- [`docs/auth-flow.md`](docs/auth-flow.md) — email-code login,
+  session store state machine, revocation watcher.
 - [`docs/storage.md`](docs/storage.md) — web KeyStore/Cache,
   IndexedDB schema, browser baseline.
 - [`docs/wasm-toolchain.md`](docs/wasm-toolchain.md) — TinyGo build,