App shell: routing, login + session auth, API/SSE client, baseline UI states

[Ryan-Atkinson87]

The application shell: routing, the login screen + session-cookie auth handling, a typed API client and SSE client, and the baseline loading/empty/error UI states every screen builds on.

Spec: §12 UI scope + auth mechanism, §2, §13.

Acceptance criteria

• App shell with client-side routing and a layout the feature screens (Run-control screen: select project/wave(s)/provider, start/stop/pause/resume #61–Profile-generation screen: trigger session, review proposed profile, confirm before write #68) mount into.
• Login screen: posts the password, relies on the HTTP-only server-side session cookie set by the backend (Single-user auth: argon2 password, session cookie, route/SSE guard #6); no token stored in JS. Authenticated routes redirect to login when the session is absent/expired (§12).
• A typed API client (no hardcoded API URLs — base from environment) and a reusable SSE client with reconnect handling, both shared by feature screens.
• Reusable loading / empty / error / populated state primitives so every data-driven screen meets the frontend production-readiness bar.
• Conforms to the baseline-ui baseline; WCAG 2.1 AA for the shell and login (keyboard, labels, focus).
• Tests: auth redirect when unauthenticated; API/SSE client error handling; login success path.

Depends on: #59, #6