feat(web): Login/Register страницы, protected routes, logout

- ProtectedRoute: loading -> спиннер, !user -> /login, иначе children
- LoginPage/RegisterPage: field+react-hook-form/zod, ошибка через role=alert,
  редирект на /domains при успехе/уже авторизован
- main.tsx: AuthProvider + QueryCache/MutationCache onError -> notifyUnauthorized
  на UnauthorizedError (сброс сессии из кода вне React-дерева)
- AuthContext: logout и notifyUnauthorized чистят react-query кэш (qc.clear())
- Layout: email пользователя + кнопка Выйти
- App: /login и /register публичные (авторизованный -> /domains), остальное
  под ProtectedRoute

Починка page-тестов (Accounts/Domains/Templates/DomainDiff/App): AuthProvider
+ мок api.auth.me, спай-ассерты обновлены под projectId-первым-аргументом
сигнатур api.* (T5).

web/src/auth/AuthContext.test.tsx

@@ -1,7 +1,8 @@
 import { render, screen, waitFor } from "@testing-library/react"
 import userEvent from "@testing-library/user-event"
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
 import { describe, it, expect, vi, beforeEach } from "vitest"
-import { AuthProvider, useAuth } from "./AuthContext"
+import { AuthProvider, notifyUnauthorized, useAuth } from "./AuthContext"
 import { api, UnauthorizedError } from "@/api/client"
 
 const USER = { id: "u1", email: "a@b.com" }
@@ -21,11 +22,13 @@ function Probe() {
   )
 }
 
-function renderProbe() {
+function renderProbe(qc: QueryClient = new QueryClient()) {
   return render(
-    <AuthProvider>
-      <Probe />
-    </AuthProvider>,
+    <QueryClientProvider client={qc}>
+      <AuthProvider>
+        <Probe />
+      </AuthProvider>
+    </QueryClientProvider>,
   )
 }
 
@@ -91,4 +94,33 @@ describe("AuthContext", () => {
     await waitFor(() => expect(screen.getByTestId("user").textContent).toBe("none"))
     expect(screen.getByTestId("project").textContent).toBe("none")
   })
+
+  it("logout clears the react-query cache", async () => {
+    vi.spyOn(api.auth, "me").mockResolvedValue({ user: USER, project: PROJECT })
+    vi.spyOn(api.auth, "logout").mockResolvedValue(undefined)
+    const qc = new QueryClient()
+    const clearSpy = vi.spyOn(qc, "clear")
+    const user = userEvent.setup()
+    renderProbe(qc)
+
+    await waitFor(() => expect(screen.getByTestId("user").textContent).toBe(USER.email))
+    await user.click(screen.getByRole("button", { name: "logout" }))
+
+    await waitFor(() => expect(clearSpy).toHaveBeenCalled())
+  })
+
+  it("notifyUnauthorized (triggered by any 401 elsewhere in the app) drops the session and clears the cache", async () => {
+    vi.spyOn(api.auth, "me").mockResolvedValue({ user: USER, project: PROJECT })
+    const qc = new QueryClient()
+    const clearSpy = vi.spyOn(qc, "clear")
+    renderProbe(qc)
+
+    await waitFor(() => expect(screen.getByTestId("user").textContent).toBe(USER.email))
+
+    notifyUnauthorized()
+
+    await waitFor(() => expect(screen.getByTestId("user").textContent).toBe("none"))
+    expect(screen.getByTestId("project").textContent).toBe("none")
+    expect(clearSpy).toHaveBeenCalled()
+  })
 })