feat(auth): enforce onboarding before app access

[maxstue]

Summary

• replace placeholder user provisioning during sign-in with an explicit /users/me onboarding state
• make onboarding completion idempotent and enforce a unique external auth ID
• protect post-onboarding API endpoints with separate onboarding and household-role authorization policies
• split authenticated client routes into onboarding and ready-app layouts using directory route.tsx files
• share current-user data through TanStack Query and clear it explicitly after logout

Why

Authenticated identities previously depended on sign-in provisioning and the frontend duplicated readiness assumptions. This made onboarding state and access control less explicit and could leave stale current-user data during authentication transitions.

Impact

The backend is now authoritative for whether onboarding is complete. Users who have not completed onboarding can access only the current-user and onboarding endpoints; application endpoints return 403. Ready users continue through the normal app routes, while the client consumes one shared current-user query.

Validation

• pnpm build
• pnpm fmt
• pnpm lint
• client typecheck and Vite production build
• API Release build and dotnet format --verify-no-changes
• pre-commit lint-staged checks for API and client
• React Doctor: 97/100, no issues
• Fallow: no newly introduced dead code or complexity findings; warnings are inherited/generated duplication
• secrets scan passed for changed source directories

Notes

pnpm audit was not executed because it sends dependency metadata to an external registry and that export was not separately authorized.

Refs: KIJK-343

[linear-code]

KIJK-343