Auth-state store + hydration + token refresh

Status: ✅ Done.

Reactive auth state for the UI, plus session restore on load with no redirect and no flash of incorrect state.

• app/stores/auth.ts is a Pinia store holding isAuthenticated and user. Both default to logged-out so that SSR and the first client paint render the anonymous view, and the logged-in state is applied only after mount.
• Header.vue restores the session on load — gated on the oidc feature flag, in onMounted, client-only — via getUser(). Logged-in state is derived purely from the stored session, so an expired access token never reports the user as logged out. Crucially there is no redirect on page load; that was the requirement oidc-spa could not meet.
• automaticSilentRenew together with the refresh token keeps the access token fresh in the background. On-demand refresh for authenticated API calls is provided separately by getAccessToken() (see the Pink-facing work).

The issue is marked done and names app/stores/auth.ts and Header.vue as the main entry points. Review the Pinia auth state, the onMounted getUser() session restore, the oidc feature-flag gate, and getAccessToken(); completion is the described hydration behavior, no redirect or flash on load, and background token renewal.