Bug FixApril 18, 2026

eliminate auth redirect race with tri-state AuthStatus

Replaces boolean auth guards with tri-state AuthStatus (loading | authenticated | unauthenticated) to eliminate the first-render redirect race on hard refresh.
ProtectedRoute rewritten to consume status, with new props: requireStaff, returnUrl, loginPath, fallback. Adopted by /platform, /organizations, /setup.
Tenant layout + community layout switched to authStatus via CommunityContext.
Adds an 11-case vitest suite for ProtectedRoute.