[rd-code-23]

What changed

• add shared runtime-validated auth contracts for public users, current-user state, and CSRF tokens
• organize shared contracts into focused auth and health feature folders
• add typed, credentialed frontend auth API helpers
• fetch and attach session-bound CSRF tokens automatically for unsafe requests
• add one authoritative TanStack Query current-user source
• represent loading, anonymous, authenticated, and error states explicitly
• add a logout mutation that synchronizes the current-user cache
• normalize 401 handling without retry or redirect loops
• add the local /auth development proxy
• enforce no-nested-ternary and simplify existing status logic

Why

React features need one typed authentication boundary without reading cookies, manually managing CSRF tokens, or duplicating server state in localStorage or Zustand.

Developer impact

Frontend authentication HTTP calls live in auth.api.ts; current-user server state lives under the single ['auth', 'current-user'] TanStack Query key. State-changing callers use the shared request helper rather than handling CSRF details themselves.

Validation

• repository-wide lint
• contracts lint, typecheck, test, and build
• API typecheck and 47 tests
• web lint, typecheck, build, and 12 tests

Closes #12