Make auth root navigation single-owned

[artiphishle]

Fixes #162

Summary

• keep the generated / entry route navigation-neutral for auth apps with a non-root post-sign-in route
• remove Redirect, withAnchor, and synthetic initial-history behavior from that route
• leave authenticated root canonicalization exclusively to the existing root-layout router.replace(...) after auth bootstrap
• preserve the root → app → tabs initialRouteName structure for natural navigator behavior
• add focused regression assertions and a patch changeset

Root cause

The generated / entry and the generated root layout both owned the transition to /products:

1. src/app/index.tsx rendered an Expo Router Redirect with withAnchor.
2. The root layout also replaced / with the authenticated post-sign-in target after auth bootstrap.

Anchoring the redirect reconstructed nested navigator history and could expose a Back button, including an initial=false navigation parameter workaround. The route transition therefore had competing owners.

Solution

The generated src/app/index.tsx remains as a renderless route so Expo Router can match /, but it no longer imports or invokes the router. It returns null while the root layout resolves authentication and performs the only canonicalizing navigation:

if (authenticated && currentPath === '/' && postSignInPath !== '/') {
  router.replace(AUTH_POST_SIGN_IN_ROUTE_TARGET);
}

This preserves the auth bootstrap boundary introduced in #155 without creating synthetic Back history.

Expected behavior

• opening / while authenticated resolves to /products with no Back button
• opening /products directly has the same effective navigation root
• no initial=false, withAnchor, or header-hiding workaround is generated
• nested routes retain normal navigator-owned Back behavior
• unauthenticated / entry still resolves through the root auth boundary

Validation

Focused Bun generation coverage now verifies:

• / remains matchable through a navigation-neutral index route
• the index route contains no Expo Router import, Redirect, withAnchor, or initial override
• the root layout owns the authenticated router.replace(...)
• root, app, and tabs initial-route configuration remains intact

Full repository validation is delegated to CI because this change was authored through the connected GitHub environment.