feat(web): add same-origin SPA authentication

apps/web/src/spa/routes.spec.tsx

@@ -1,6 +1,8 @@
+import { isValidElement } from 'react';
 import { describe, expect, it } from 'vitest';
 import type { RouteObject } from 'react-router-dom';
 import { routes } from '@/routes';
+import { Placeholder } from '@/spa/placeholder';
 
 function collectPaths(routeObjects: RouteObject[]): string[] {
   return routeObjects.flatMap((route) => [
@@ -9,6 +11,15 @@ function collectPaths(routeObjects: RouteObject[]): string[] {
   ]);
 }
 
+function findRoute(routeObjects: RouteObject[], path: string): RouteObject | undefined {
+  for (const route of routeObjects) {
+    if (route.path === path) return route;
+    const nested = route.children ? findRoute(route.children, path) : undefined;
+    if (nested) return nested;
+  }
+  return undefined;
+}
+
 describe('SPA route table', () => {
   it('covers every v1 parity route from the Phase P RFC', () => {
     expect(collectPaths(routes).sort()).toEqual(
@@ -34,4 +45,14 @@ describe('SPA route table', () => {
     expect(guestPaths).not.toContain('/chat');
     expect(authPaths).toContain('/chat');
   });
+
+  it.each(['/login', '/register', '/auth/provider/:provider'])(
+    'renders a real guest page instead of the P1 placeholder at %s',
+    (path) => {
+      const element = findRoute(routes, path)?.element;
+      expect(isValidElement(element)).toBe(true);
+      if (!isValidElement(element)) throw new Error(`Missing route element for ${path}`);
+      expect(element.type).not.toBe(Placeholder);
+    },
+  );
 });