feat(web): Login/Register страницы, protected routes, logout

- ProtectedRoute: loading -> спиннер, !user -> /login, иначе children
- LoginPage/RegisterPage: field+react-hook-form/zod, ошибка через role=alert,
  редирект на /domains при успехе/уже авторизован
- main.tsx: AuthProvider + QueryCache/MutationCache onError -> notifyUnauthorized
  на UnauthorizedError (сброс сессии из кода вне React-дерева)
- AuthContext: logout и notifyUnauthorized чистят react-query кэш (qc.clear())
- Layout: email пользователя + кнопка Выйти
- App: /login и /register публичные (авторизованный -> /domains), остальное
  под ProtectedRoute

Починка page-тестов (Accounts/Domains/Templates/DomainDiff/App): AuthProvider
+ мок api.auth.me, спай-ассерты обновлены под projectId-первым-аргументом
сигнатур api.* (T5).

web/src/App.test.tsx

@@ -1,19 +1,30 @@
 import { render, screen, within } from "@testing-library/react"
 import { MemoryRouter } from "react-router-dom"
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
+import { vi, test, expect } from "vitest"
 import { App } from "./App"
+import { AuthProvider } from "@/auth/AuthContext"
+import { api } from "@/api/client"
+
+test("renders navigation and redirects to domains", async () => {
+  vi.spyOn(api.auth, "me").mockResolvedValue({
+    user: { id: "u1", email: "a@b.com" },
+    project: { id: "p1", name: "Default" },
+  })
+  vi.spyOn(api, "listDomains").mockResolvedValue([])
 
-test("renders navigation and redirects to domains", () => {
   render(
     <QueryClientProvider client={new QueryClient()}>
-      <MemoryRouter initialEntries={["/"]}>
-        <App />
-      </MemoryRouter>
+      <AuthProvider>
+        <MemoryRouter initialEntries={["/"]}>
+          <App />
+        </MemoryRouter>
+      </AuthProvider>
     </QueryClientProvider>,
   )
   // Sidebar nav also renders a "Domains" link label, so scope the assertion
   // to the routed page content to unambiguously confirm the redirect + page.
-  const main = screen.getByRole("main")
+  const main = await screen.findByRole("main")
   expect(within(main).getByText("Domains")).toBeInTheDocument()
   expect(screen.getByRole("link", { name: /domains/i })).toBeInTheDocument()
 })