feat(web): add same-origin SPA authentication

apps/web/src/spa/guards.tsx

@@ -1,12 +1,23 @@
 import type { ReactElement } from 'react';
-import { Outlet } from 'react-router-dom';
-
-// P1 shells: session-aware redirects arrive with the reworked auth client in P2.
+import { Navigate, Outlet } from 'react-router-dom';
+import { useSession } from '@/lib/auth-client';
 
 export function GuestGuard(): ReactElement {
-  return <Outlet />;
+  const { data: session } = useSession();
+
+  return session ? <Navigate to="/chat" replace /> : <Outlet />;
 }
 
 export function AuthGuard(): ReactElement {
-  return <Outlet />;
+  const { data: session, isPending } = useSession();
+
+  if (isPending) {
+    return (
+      <div className="flex min-h-screen items-center justify-center">
+        <div className="text-sm text-text-muted">Loading...</div>
+      </div>
+    );
+  }
+
+  return session ? <Outlet /> : <Navigate to="/login" replace />;
 }