fix(admin): P1-04 AuthGuard race condition — always validate cookie before render

Root cause: loadFromStorage() set isAuthenticated=true from localStorage
without validating the HttpOnly cookie. On page refresh with expired cookie,
children rendered and made failing API calls before AuthGuard could redirect.

Fix:
- authStore: isAuthenticated starts false, never trusted from localStorage
- AuthGuard: always calls GET /auth/me on mount (unless login flow set it)
- Three-state guard (checking/authenticated/unauthenticated) eliminates race

admin-v2/src/stores/authStore.ts

@@ -37,9 +37,11 @@ function loadFromStorage(): { account: AccountPublic | null; isAuthenticated: bo
   if (raw) {
     try { account = JSON.parse(raw) } catch { /* ignore */ }
   }
-  // If account exists in localStorage, mark as authenticated (cookie validation
-  // happens in AuthGuard via GET /auth/me — this is just a UI hint)
-  return { account, isAuthenticated: account !== null }
+  // IMPORTANT: Do NOT set isAuthenticated = true from localStorage alone.
+  // The HttpOnly cookie must be validated via GET /auth/me before we trust
+  // the session. This prevents the AuthGuard race condition where children
+  // render and make API calls with an expired cookie.
+  return { account, isAuthenticated: false }
 }
 
 interface AuthState {