fix(ui): redirect app root to lobby/login; evict stale root service worker

- The app root ("/", i.e. /game/) rendered a dev "workspace skeleton"
  stub, and the layout guard only redirected anonymous users off it, so
  an authenticated visitor stayed on the stub. Redirect "/" to /lobby
  (authenticated) and /login (anonymous), and replace the stub with a
  minimal loading placeholder. Drop the obsolete landing-stub unit test
  (root redirect is covered by the auth-flow e2e).
- Ship a tombstone /service-worker.js on the project site so any old
  root-scoped PWA worker (from when the game lived at the origin root)
  unregisters itself instead of serving a stale cached page at the
  site origin. The game now registers its worker only under /game/.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

site/public/service-worker.js

@@ -0,0 +1,24 @@
+// Tombstone service worker for the site origin's root scope (`/`).
+//
+// The game UI used to be served at this origin's root with a
+// root-scoped service worker. It now lives under `/game/` (its own
+// scoped worker), and the project site served at `/` ships no service
+// worker of its own. This file exists only so any lingering old
+// root-scoped worker, on its next update check, replaces itself with
+// this one — which unregisters itself and reloads its controlled pages
+// so they fall through to the live network (the site) instead of a
+// stale cache. New visitors never register it; nothing here calls
+// `register`.
+self.addEventListener("install", () => self.skipWaiting());
+
+self.addEventListener("activate", (event) => {
+	event.waitUntil(
+		(async () => {
+			await self.registration.unregister();
+			const clients = await self.clients.matchAll({ type: "window" });
+			for (const client of clients) {
+				client.navigate(client.url);
+			}
+		})(),
+	);
+});