fix: prevent auth-state flash on homepage, login, and dashboard
Show a loading spinner instead of route-specific content when the auth
state is still resolving or when a redirect is pending. This stops
authenticated users from briefly seeing the logged-out landing page,
login form, or dashboard skeleton before the useEffect redirect fires.