feat(frontend): add (app) route group and rework auth routing

Move authenticated pages under an (app) group with a Sidebar shell, add /auth/login and page-based /login, drop the old explore page and login +server endpoint, and add the server upload helper.

frontend/src/routes/+layout.server.ts

@@ -1,5 +1,11 @@
+import { redirect } from '@sveltejs/kit';
 import type { LayoutServerLoad } from './$types';
 
-export const load: LayoutServerLoad = ({ locals }) => ({
-	user: locals.user
-});
+const PUBLIC_PATHS = new Set(['/login']);
+
+export const load: LayoutServerLoad = ({ locals, url }) => {
+	if (!locals.user && !PUBLIC_PATHS.has(url.pathname)) {
+		redirect(302, `/login?returnTo=${encodeURIComponent(url.pathname + url.search)}`);
+	}
+	return { user: locals.user };
+};