Handle OAuth token, auth UI and route guards
Use URL search params for OAuth callback and set cli flag.
Home reads did from query, fetches /token, stores token and
redirects to /projects. Main redirects unauthenticated users to
/. Navbar, SignIn and Sidebar updates: sign out clears token and
redirects to /, authenticated state toggles menus, logo links to
/projects, modal close/reset and button/style tweaks.