phase 7: auth flow UI (email-code login + session resume + revocation)

Implements ui/PLAN.md Phase 7 end-to-end:

- /login two-step form (email -> code) over the gateway public REST
  surface; /lobby placeholder issues the first authenticated
  user.account.get and renders the decoded display name.
- SessionStore (Svelte 5 runes) with loading / unsupported / anonymous /
  authenticated states; layout-level route guard, browser-not-supported
  blocker, and a minimal SubscribeEvents revocation watcher that closes
  the active client within 1s on a clean stream end or
  Unauthenticated.
- VITE_GATEWAY_BASE_URL + VITE_GATEWAY_RESPONSE_PUBLIC_KEY config plus
  AuthError taxonomy in api/auth.ts.
- Vitest (auth-api, session-store, login-page) and Playwright e2e
  (auth-flow.spec.ts) on the four configured projects, with a fixture
  Ed25519 keypair forging Connect-Web JSON responses.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

ui/frontend/tests/e2e/fixtures/gateway-key.ts

@@ -0,0 +1,17 @@
+// Deterministic Ed25519 keypair used by the Phase 7 Playwright e2e
+// suite to forge gateway-shaped responses inside `page.route(...)`.
+// The pair was generated once with Node's WebCrypto and is checked
+// in: it is purely test fixture material, not used in production
+// builds, and the public half lands in the dev server via
+// `VITE_GATEWAY_RESPONSE_PUBLIC_KEY` from `playwright.config.ts`.
+
+export const FIXTURE_PUBLIC_KEY_RAW_BASE64 =
+	"3Jf1C+qApVeysTytS6umsvTGqNfn3oHcagJhO97Ias4=";
+
+export const FIXTURE_PRIVATE_KEY_PKCS8_BASE64 =
+	"MC4CAQAwBQYDK2VwBCIEIGnpfNAYxKJivan1ww5uvidgozuz9JXQM9dcdYrSiHHt";
+
+export function decodeBase64(value: string): Uint8Array {
+	const bin = Buffer.from(value, "base64");
+	return new Uint8Array(bin.buffer, bin.byteOffset, bin.byteLength);
+}