fix(auth): stop password-login session being wiped on initial mount

Two bugs in onAuthStateChange that bounced password-authed users to
/login when they navigated directly to a deep URL:
- The handler unconditionally cleared dbUser when Supabase had no
  session, even if a custom JWT (password login) was active.
- The handler unconditionally flipped loading=false on every Supabase
  event, including the initial INITIAL_SESSION emitted before the
  custom-JWT fetchDbUser had finished. Route guards then ran with
  loading=false and dbUser=null and redirected.

Now: only clear dbUser if there is no custom token, and let the
custom-token path own setLoading(false) when it's the active session.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: WangYuTengg

src/client/contexts/AuthContext.tsx

@@ -78,14 +78,18 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     } = supabase.auth.onAuthStateChange((_event: string, session: Session | null) => {
       setSession(session);
       setUser(session?.user ?? null);
-      
+
+      const hasCustomToken = !!localStorage.getItem(CUSTOM_TOKEN_KEY);
+
       if (session?.access_token) {
         fetchDbUser(session.access_token);
-      } else {
+        setLoading(false);
+      } else if (!hasCustomToken) {
+        // No Supabase session and no custom JWT → fully signed out.
         setDbUser(null);
+        setLoading(false);
       }
-      
-      setLoading(false);
+      // else: custom-JWT login is in flight; let its fetchDbUser.finally flip loading.
     });
 
     return () => subscription.unsubscribe();